FBI Issues Flash Warning: Handala Hackers Using Telegram Bots as C2 Infrastructure for Malware Campaigns

The FBI released FLASH-20260320-001 warning that Iran's MOIS cyber actors are using Telegram bot API as bidirectional command-and-control infrastructure to push Windows malware targeting Iranian dissidents, journalists, and opposition groups worldwide. The FBI formally attributed Handala Hack to MOIS, linking it to 'Homeland Justice.' This follows the March 11 Stryker attack where Handala compromised Microsoft Intune and wiped 200,000+ devices across 79 countries. After DOJ seized four Handala domains, the group launched replacement infrastructure and mocked the seizure on Telegram within hours.