The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE.
"HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said.
On the other hand, CRUDEEXCLUDE is a Delphi-based Windows utility employed to prepare environments for the deployment of subsequent stages such as HEAVYGRAM. First observed in late July 2024, the malware is often disguised as a legitimate application with a graphical user interface (GUI), and configures Microsoft Defender exclusion paths for defense evasion.
The findings build upon an alert the U.S. Federal Bureau of Investigation (FBI) first issued in March 2026 and again earlier this week, in which it accused Iranian cyber actors acting on behalf of the Ministry of Intelligence and Security (MOIS) of targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups to conduct intelligence collection, leak data, and inflict reputational harm against targets of interest.
It's worth noting the U.K. National Cyber Security Center is tracking the same malware family under the moniker CHOSEN BRICK, describing it as a flexible tool that can be used to "support a range of potential operational outcomes."
The attacks typically involve the use of social engineering via messaging platforms like Telegram, WhatsApp, and Instagram to communicate with targets under the pretext of offering technical support or posing as trusted contacts, and then deliver malware dressed up as a seemingly harmless installer to trigger the infection. These applications masquerade as legitimate applications like Pictory, KeePass, and Telegram, and contain the second-stage implant.
Handala Hack, which came into being shortly after the October 7, 2023, armed attacks by Hamas and other Palestinian militant groups targeting southern Israel, is assessed to be an online persona operated by Void Manticore (aka Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's MOIS. It has a history of conducting destructive wiping attacks and hack and leak operations.
In an alert issued last September, the Canadian Rapid Response Mechanism (RRM) called out the threat actor for targeting and doxxing five Iran International journalists, including one from the country, as part of a hack and leak operation.
According to Group-IB, HEAVYGRAM was first detected in the wild in September 2023. Once launched, the malware prevents Defender from scanning the paths staging the malicious payloads and executes PowerShell code to set up persistence for the next-stage implant via the Windows Registry.
A notable aspect of the Python-based malware is its use of Telegram for command-and-control (C2), allowing it to list running programs, take screenshots, capture web browser data, upload/download files, turn on the microphone, copy Telegram and WhatsApp data, steal saved passwords, download additional malware, and delete files.
Incoming messages from the Telegram bot are parsed based on a prefix delimiter system -
- Prefix @@, to execute arbitrary system commands via os.popen
- Prefix **, to write the message body to C:\ProgramData\ur.txt
-
Prefix ##, to enable a backdoor command suite that supports the following capabilities -
- runexe - Start an arbitrary process on the host
- whois - Retrieve the host's public IP address via api.ipify[.]org
- runtro - Execute a secondary trojan payload
- cht - Dynamically update the C2 Telegram bot token and operator user ID
- regtro - Install the trojan payload into Windows autorun Registry keys
- reg - Install the main malware executable into Windows autorun registry keys
- dt - Exfiltrate Telegram Desktop application data
"Attachments received through the Telegram bot are handled based on filename pattern matching," Group-IB said. "The persistent implant handles C2 communication via two functions: send_initial_message – transmits an initial connection beacon containing the full computer domain name of the compromised host, [and] send_health_msg – a background thread that sends a heartbeat message every 24 hours with the host’s domain name, confirming that the implant remains active."
HEAVYGRAM has been found to be delivered through four methods: WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE containing embedded archives. CRUDEEXCLUDE was first documented by Google in December 2025 as being used to set up staging directories for housing HEAVYGRAM and another specified malware family named SHADEGENES while masquerading as legitimate applications like Pictory and Telegram.
Further review of the Telegram infrastructure has revealed two main setups: one where C2 relies on a single Telegram bot and group, and another where one bot handles check-ins while a secondary bot manages logging and stage polling with a group.
"The newly identified samples demonstrate a flexible, multi-stage infection chain in which operators combine tailored social engineering, application masquerading, defense evasion and persistent access to compromise targets of interest," Group-IB said. "The extensive use of Telegram across operations is particularly notable, providing operators with a natively encrypted command-and-control channel that has low setup, maintenance and rotation cost."
