Iran-Linked Hackers Use Messaging Platform to Target Dissidents and Journalists

**Executive Summary:** The FBI alert describes a targeted, multi-stage malware campaign attributed to Iran-linked MOIS actors that uses social engineering to deliver Windows implants which establish Telegram-based C2, record screen/audio, capture and exfiltrate files, and maintain persistence; the campaign targets dissidents and journalists and is linked to hack-and-leak activity (Handala Hack), increasing the risk of reputational and intelligence exposure.