Iranian cyber actors are using a malware family known as HEAVYGRAM, also tracked as CHOSEN BRICK, to target dissidents, journalists, and opposition groups worldwide, according to a recent FBI FLASH report and a joint advisory from the UK National Cyber Security Centre (NCSC), the US FBI, and the Netherlands' General Intelligence and Security Service (AIVD). The FBI assesses that the malware is deployed on behalf of the Government of Iran's Ministry of Intelligence and Security (MOIS) to collect intelligence, conduct data leaks, and cause reputational harm to targets. The joint advisory adds that Iran almost certainly uses cyber activity to support repression of individuals seen as threats to the regime.

Who Is Being Targeted by Iranian Cyber Actors

The victim profile includes Iranian dissidents, journalists opposed to Iran, members of organizations with views countering Government of Iran narratives, and other individuals the Iranian government perceives as threats. The joint advisory notes that CHOSEN BRICK has been used against individuals in the UK, US, and Netherlands since at least 2025, and that personal details of some victims have appeared on pro-Iranian leak sites, increasing risks to their personal safety. In some cases, Iranian intelligence services have plotted to kidnap or conduct lethal operations against individuals abroad who are seen as enemies of the regime.

Social Engineering and Delivery

Iranian cyber actors rely heavily on social engineering to deliver their malware. Actors communicate with targets through platforms such as Telegram, WhatsApp, and Instagram, often posing as individuals known to the target or as technical support from the messaging platform. The joint advisory notes that actors research targets in advance to appear credible, and often initiate contact through a target's work device before shifting to personal devices if the initial delivery attempt fails or risks detection. Victims are persuaded to download files disguised as legitimate applications, including Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, and KeePass, or files appearing to be MRI scan results. The FBI notes that some victims downloaded AnyDesk and provided access strings, while others downloaded malware masquerading as a program installer. The malware targets only the Windows operating system.

Persistence and Telegram Command and Control

Once installed, the malware achieves persistence by adding registry keys, most often within the Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run, so it runs automatically at user login. It also adds exclusions to Microsoft Defender antivirus to evade detection. The malware then connects to Telegram command-and-control infrastructure, with each victim device linked to a unique Telegram Bot ID to prevent cross-contamination between victims. Through Telegram, the malware can enumerate running processes and system information, capture screen content, enable the microphone to record audio, copy Telegram and WhatsApp data from browsers, download additional files, delete files, steal email content, and wipe the computer system. Files and data are exfiltrated through the Telegram bot and cloud object stores such as VultrObjects and StorjShare. Recent variants use HTTPS/SOCKS5 proxies to obscure the use of Telegram bots.

FBI Recommendations

The FBI recommends caution regarding communications from unknown individuals, keeping devices updated, downloading software only from trusted sources, enabling antivirus software, using strong unique passwords with multi-factor authentication, and reporting suspicious messages. The NCSC, FBI, and AIVD jointly recommend phishing-resistant multi-factor authentication, application allowlisting, email scanning security features, and endpoint and network monitoring. Organizations concerned about a potential HEAVYGRAM or CHOSEN BRICK infection are advised to contact their IT providers and check both corporate and personal devices, since the actors also target individuals outside their workplace systems.

The FBI is warning the public about sexual exploitation actors illegally accessing social media and personal accounts to steal explicit images and videos from adult and underage victims. The stolen material, also known as non-consensual intimate images (NCII), is being posted or sold on criminal marketplaces, often without the victim's knowledge.

According to the FBI, these actors use social engineering and cyber intrusion tactics to target specific individuals or general targets of opportunity. After gaining access to accounts, they steal explicit content and share it through community forums or illicit marketplaces.

The FBI said personally identifiable information, including a victim's name, date of birth, email address, phone number and social media username, is often posted alongside the stolen material. This can expose victims to continued harassment and re-victimization.

How Sexual Exploitation Actors Access Accounts

The FBI has identified several methods used by sexual exploitation actors to gain access to victims' accounts.

Password and PIN Targeting

In password/PIN targeting, actors use high-volume password and PIN attempts against social media and personal accounts. The information used in these attempts can come from data leak sites, social media and open-source information.

When victims are known to the actors, curated lists may include personal details such as names, date of birth or variations of those details.

Social Media Customer Service Impersonation

Another tactic involves social media customer service impersonation through text messages. Victims may receive messages claiming their account is being disabled or locked unless they provide a verification code.

The actor then requests a password reset, causing a code to be sent to the victim. If the victim shares the code, the actor can reset the password and access the account.

Phishing Emails

The FBI also warns about phishing campaigns using look-alike domains and email accounts designed to appear as social media customer support.

These messages may claim there has been a new login and contain an embedded link asking the victim to change their password. Clicking the malicious link can give the actor access to the account.

Stolen Content Can Lead to Further Attacks

Once explicit content is stolen, sexual exploitation actors may post or sell it while including personal information about the victim. The FBI said victims can subsequently face harassment, sextortion, stalking or other targeted attacks.

The actors may also advertise stolen content through a victim's own social media page, increasing the potential for further exposure.

FBI Shares Steps to Protect Accounts

The FBI advises people to avoid storing sensitive images or videos on social media platforms or other internet-accessible sites.

It recommends using unique, complex passphrases and PINs along with multi-factor authentication (MFA). Password information directly associated with a person's identity, including names or birthdays, should be avoided.

Users should also be cautious with links received through emails and text messages. The FBI recommends going directly to the relevant website to address account concerns and checking URLs before clicking.

Unrequested temporary passwords, PIN resets or access codes should also be treated with caution. The FBI advises users not to share login information, even when someone claims to represent a platform or service.

People who believe their explicit content was stolen or leaked can provide information through the FBI's NCII reporting site. The FBI also advises the public to continue reporting fraud, scams and cyber threats to the Internet Crime Complaint Center or a local FBI Field Office.