Iranian Hackers Using New Spying Malware That Abuses Telegram Messenger API

Mandiant attributed the attack to an uncategorized cluster it is tracking under the moniker UNC3313, which it assesses with "moderate confidence" as associated with the MuddyWater APT group.