ThreatPaper

Surveillance & Lawful Intercept

1 case

Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2

A joint NCSC/FBI/AIVD advisory published September 15, 2026 details HEAVYGRAM (CHOSEN BRICK), a Telegram-controlled Windows backdoor Iran's MOIS-linked Handala Hack uses to surveil dissidents and journalists — the same actor behind the Stryker wiper attack and DOJ domain seizures.

State-SponsoredSurveillance & Lawful InterceptMalwareSocial Engineering