Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

Summary

The Iran-linked Handala Hack persona has been linked to the HEAVYGRAM Telegram-based surveillance backdoor and the CRUDEEXCLUDE utility. This malware, first seen in July 2024, is designed for intelligence gathering, including stealing passwords, capturing screenshots, and exfiltrating data. It often masquerades as legitimate software and uses Microsoft Defender exclusion paths for evasion, with command and control managed via Telegram.

Full text

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords Ravie LakshmananSep 17, 2026Cyber Espionage / Malware The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said. On the other hand, CRUDEEXCLUDE is a Delphi-based Windows utility employed to prepare environments for the deployment of subsequent stages such as HEAVYGRAM. First observed in late July 2024, the malware is often disguised as a legitimate application with a graphical user interface (GUI), and configures Microsoft Defender exclusion paths for defense evasion. The findings build upon an alert the U.S. Federal Bureau of Investigation (FBI) first issued in March 2026 and again earlier this week, in which it accused Iranian cyber actors acting on behalf of the Ministry of Intelligence and Security (MOIS) of targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups to conduct intelligence collection, leak data, and inflict reputational harm against targets of interest. It's worth noting the U.K. National Cyber Security Center is tracking the same malware family under the moniker CHOSEN BRICK, describing it as a flexible tool that can be used to "support a range of potential operational outcomes." The attacks typically involve the use of social engineering via messaging platforms like Telegram, WhatsApp, and Instagram to communicate with targets under the pretext of offering technical support or posing as trusted contacts, and then deliver malware dressed up as a seemingly harmless installer to trigger the infection. These applications masquerade as legitimate applications like Pictory, KeePass, and Telegram, and contain the second-stage implant. Handala Hack, which came into being shortly after the October 7, 2023, armed attacks by Hamas and other Palestinian militant groups targeting southern Israel, is assessed to be an online persona operated by Void Manticore (aka Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's MOIS. It has a history of conducting destructive wiping attacks and hack and leak operations. In an alert issued last September, the Canadian Rapid Response Mechanism (RRM) called out the threat actor for targeting and doxxing five Iran International journalists, including one from the country, as part of a hack and leak operation. According to Group-IB, HEAVYGRAM was first detected in the wild in September 2023. Once launched, the malware prevents Defender from scanning the paths staging the malicious payloads and executes PowerShell code to set up persistence for the next-stage implant via the Windows Registry. A notable aspect of the Python-based malware is its use of Telegram for command-and-control (C2), allowing it to list running programs, take screenshots, capture web browser data, upload/download files, turn on the microphone, copy Telegram and WhatsApp data, steal saved passwords, download additional malware, and delete files. Incoming messages from the Telegram bot are parsed based on a prefix delimiter system - Prefix @@, to execute arbitrary system commands via os.popen Prefix **, to write the message body to C:\ProgramData\ur.txt Prefix ##, to enable a backdoor command suite that supports the following capabilities - runexe - Start an arbitrary process on the host whois - Retrieve the host's public IP address via api.ipify[.]org runtro - Execute a secondary trojan payload cht - Dynamically update the C2 Telegram bot token and operator user ID regtro - Install the trojan payload into Windows autorun Registry keys reg - Install the main malware executable into Windows autorun registry keys dt - Exfiltrate Telegram Desktop application data "Attachments received through the Telegram bot are handled based on filename pattern matching," Group-IB said. "The persistent implant handles C2 communication via two functions: send_initial_message – transmits an initial connection beacon containing the full computer domain name of the compromised host, [and] send_health_msg – a background thread that sends a heartbeat message every 24 hours with the host’s domain name, confirming that the implant remains active." HEAVYGRAM has been found to be delivered through four methods: WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE containing embedded archives. CRUDEEXCLUDE was first documented by Google in December 2025 as being used to set up staging directories for housing HEAVYGRAM and another specified malware family named SHADEGENES while masquerading as legitimate applications like Pictory and Telegram. Further review of the Telegram infrastructure has revealed two main setups: one where C2 relies on a single Telegram bot and group, and another where one bot handles check-ins while a secondary bot manages logging and stage polling with a group. "The newly identified samples demonstrate a flexible, multi-stage infection chain in which operators combine tailored social engineering, application masquerading, defense evasion and persistent access to compromise targets of interest," Group-IB said. "The extensive use of Telegram across operations is particularly notable, providing operators with a natively encrypted command-and-control channel that has low setup, maintenance and rotation cost." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, Malware, Nation-State, Social Engineering, Windows Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibili

Indicators of Compromise

• malware — HEAVYGRAM
• malware — CRUDEEXCLUDE
• malware — CHOSEN BRICK
• domain — api.ipify.org

Entities