FBI warns of Iranian cyber actors using Telegram for malware distribution
AI-generated from multiple sources. Verify before acting on this reporting.
WASHINGTON — The Federal Bureau of Investigation issued a public warning on Monday alerting organizations and individuals to a new campaign by Iranian cyber actors distributing malware through the messaging application Telegram.
The FBI stated that the actors are leveraging Telegram channels and private messages to disseminate malicious software designed to compromise computer systems. The warning, released on March 31, 2026, details the methods used by the threat actors to target victims across various sectors.
Iranian state-sponsored groups have increasingly utilized social media and messaging platforms to conduct cyber operations. Telegram, known for its encryption and anonymity features, has become a preferred channel for these operations due to its difficulty in monitoring. The FBI noted that the malware distributed through these channels can steal sensitive data, install remote access trojans, and create backdoors for future attacks.
The agency emphasized that the campaign is sophisticated and poses a significant risk to critical infrastructure, financial institutions, and government entities. The malware often disguises itself as legitimate documents or software updates to trick users into downloading and executing the malicious code.
Cybersecurity experts have observed similar tactics in previous campaigns attributed to Iranian actors. The use of Telegram allows the threat actors to reach a wide audience while maintaining a level of operational security. The FBI advised organizations to implement robust cybersecurity measures, including email filtering, endpoint protection, and user awareness training.
The warning comes amid heightened tensions between the United States and Iran over various geopolitical issues. While the specific motivations behind this campaign remain unclear, the timing suggests a potential link to ongoing regional conflicts or intelligence gathering efforts.
The FBI has not disclosed the number of confirmed infections or the specific targets of the malware. The agency is working with international partners to track the spread of the malware and mitigate the threat. Law enforcement officials are also investigating the infrastructure used by the Iranian actors to distribute the malicious software.
Organizations are urged to monitor their networks for signs of compromise and report any suspicious activity to the FBI. The agency has provided technical indicators of compromise to help cybersecurity teams identify and block the malware.
The situation remains fluid as investigators continue to analyze the malware and trace its origins. The FBI has not ruled out the possibility of additional campaigns or variations of the malware being deployed in the coming weeks. The public is advised to exercise caution when interacting with unsolicited messages or links on messaging platforms.
As the investigation progresses, the FBI will provide updates on the scope of the threat and any new developments. The agency is committed to protecting U.S. interests and preventing cyber attacks that could harm national security or economic stability.