Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Summary: Group-IB attributed the Iran-linked Handala Hack persona to HEAVYGRAM, a Python-based Telegram backdoor first seen in the wild in September 2023 that supports remote command execution, screenshot capture, browser and Telegram/WhatsApp data theft, saved password theft, microphone activation, and persistence via Windows autorun registry keys. The malware is delivered through WSF/VBS scripts, HTA files, executables with embedded archives, and the Delphi-based CRUDEEXCLUDE utility, which sets Microsoft Defender exclusion paths and masquerades as applications like Pictory, KeePass, and Telegram. The FBI has tied the activity to Iranian actors working for the Ministry of Intelligence and Security (MOIS) targeting dissidents and journalists, and the U.K. NCSC tracks the same family as CHOSEN BRICK.
Key Takeaway: The operators use Telegram itself as an encrypted command-and-control channel with low setup and rotation cost, so blocking the app outright is not a simple answer for organizations that depend on it. Handala Hack has a documented history of destructive wiping and hack-and-leak operations, including the doxxing of five Iran International journalists cited by Canada's RRM.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026