Iranian spyware hides command traffic in per-victim Telegram bots and commercial object storage

Each implant ships with its own Telegram bot token, according to a dev.to summary of the joint advisory ^[15]. Commands and check-ins go to api.telegram.org, a legitimate service with valid certificates ^[6][12]. A firewall log shows an encrypted session to Telegram and not much else ^[6]. Stolen data leaves over the same bot channel and through Vultr object storage, Storj and Backblaze B2 ^[5]. The write-up says blocking Telegram outright has a cost, and that the bot traffic blends into ordinary encrypted traffic ^[6].

The per-victim design also limits what a takedown gets you. I'd expect a revoked token to close one victim's channel and leave every other implant running ^[5].

The published network indicators are api.telegram.org, vultrobjects.com, storjshare.io, shturl.cc and commercial proxy providers ^[12]. An organisation whose staff use Telegram, or whose developers use those storage services, cannot block them without breaking its own work ^[6]. The write-up proposes a different signal: Telegram API requests from hosts that have no business talking to it ^[15]. To use that signal you need a list of which machines are expected to use Telegram, plus proxy or DNS logs that record which host made each request.

The host side has more to work with. Persistence runs through registry Run keys, and the implant adds Defender folder exclusions to protect itself ^[10]. The write-up says those exclusion changes deserve an alert on their own because legitimate software rarely needs them ^[16]. Investigators also found a hidden SysWOW64 directory whose name ends in a trailing space, a file-system hunting clue ^[11].

Of the three, I think the Defender exclusion alert will last longest. The indicators cover the versions analysed, and newer builds may differ ^[18]. A directory name costs the operators one edit to change in the next build. Protecting the payload from Defender is a need that stays.

Delivery is manual. The implant does not self-propagate, so every infection starts with an operator on WhatsApp or Telegram posing as an acquaintance or technical support and asking the target to run a file ^[9][3]. The two-stage loader sits behind a graphical interface that looks like a legitimate installer ^[4]. Lures include Pictory, KeePass, Telegram, RunwayML, Norton and a fake MRI result, and Adobe Flash Player still works as bait in 2026 ^[13].

The main targets are high-risk individuals ^[17]. The behavioural signals above assume someone is collecting network logs and registry events for the machine. On a personal laptop there is often nobody doing that. The NCSC offers a free cyber-defence service to people it assesses as high risk, and that service does not need an endpoint agent ^[17].

The agencies say the tooling has been in use since at least 2025, and the wider campaign goes back to autumn 2023 ^[2]. The FBI published FLASH-20260320-001 on the campaign, and the US Department of Justice seized four Iranian leak sites in March 2026 ^[14]. The advisory does not publish victim counts or attribute specific intrusions beyond the intelligence services it names ^[18].