Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The HEAVYGRAM backdoor highlights how sophisticated threat actors combine social engineering with living-off-the-land techniques — in this case, abusing Microsoft Defender exclusion paths to evade endpoint detection while masquerading as legitimate software. By leveraging Telegram as a command-and-control channel, the malware blends into normal network traffic, making detection significantly harder. This campaign underscores the danger of users executing unverified software and the critical importance of hardening endpoint configurations against deliberate evasion. Organizations without robust monitoring of Defender policy changes and outbound messaging-app traffic are particularly exposed to this class of threat.