Iranian state-linked threat actors (Handala, attributed to MOIS; Homeland Justice, attributed to IRGC) are actively using Telegram as command-and-control infrastructure to deliver malware and wiper payloads against journalists, dissidents, and enterprise organizations. The reported impact at Stryker Corporation involved approximately 80,000 devices wiped via abuse of Microsoft Intune for mass device reset, alongside data exfiltration and public leaks. Organizations using Microsoft Intune or with Telegram accessible from managed endpoints face elevated risk of destructive, unrecoverable data loss.