At a Glance Attribute Details Malware Family HEAVYGRAM (associated with CRUDEEXCLUDE) Threat Actor Handala Hack (suspected persona of Void Manticore / MOIS) Target Victims Iranian dissidents, Farsi-language journalists, and academic targets Delivery Vector Social engineering, malicious scripts, and trojanized installers Key Capabilities Screen recording, Telegram session theft, remote command execution Source Group-IB Threat Intelligence Executive Summary Security researchers discovered 29 new samples of the HEAVYGRAM malware targeting dissidents and reporters.

HEAVYGRAM is a versatile tool capable of remote command execution, system and network information discovery, data exfiltration, screenshot capture, and establishing persistence through Windows registr...

イラン関連のHandala Hackグループが、Telegram経由で動作するバックドアHEAVYGRAMを使用。パスワード、メッセージデータ、スクリーンショット、ファイルの窃取が可能。対象組織は影響評価を急ぐ必要がある。

Handala Hack is linked to HEAVYGRAM, a Telegram-based backdoor that can steal passwords, messaging data, screenshots, and files.

Handala Hack is linked to HEAVYGRAM, a Telegram-based backdoor that can steal passwords, messaging data, screenshots, and files.

HEAVYGRAM is a Windows surveillance backdoor that turns Telegram into an operational command center for attackers. Rather than relying on a dedicated server, it uses bots, accounts and groups to rece…

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

Haz clic para acceder al contenido completo.

Handala Hack is linked to HEAVYGRAM, a Telegram-based backdoor that can steal passwords, messaging data, screenshots, and files.

Iranian cyber actors are using HEAVYGRAM and CHOSEN BRICK malware via Telegram to target dissidents, journalists, and activists worldwide.

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

De nieuw ontdekte surveillance-malware, HEAVYGRAM genaamd, maakt effectief gebruik van de populaire berichtenapp Telegram als commandocentrum. Dit elimineert de noodzaak voor aparte communicatieservers. De malware, die sinds de herfst van 2023 wordt ingezet, richt zich op journalisten, Iraanse dissidenten en personen die kritisch staan tegenover de Iraanse regering. Het onderzoek koppelt HEAVYGRAM aan een campagne gericht op personen van belang voor Iran, waaronder een journalist bij een in het VK gevestigd Farsi-taal nieuwsmedium en een slachtoffer in de VS. HEAVYGRAM communiceert via Telegram bots, accounts en groepen. Aanvallers versturen instructies en ontvangen gestolen data, en kunn...

イラン寄りのHandala Hack作戦と中程度の確信度で関連付けられる、これまで報告されていなかったマルウェア「HEAVYGRAM」および「CRUDEEXCLUDE」のサンプルが確認されました。アンチマルウェアソフトウェア このキャンペーンは、標的型ソーシャルエンジニアリング、Microsoft Defenderの

The FBI has released a major technical update on Iranian government-linked cyber activity targeting dissidents, journalists, opposition groups, and other individuals viewed as threats by Tehran, ad…

Group-IB Threat Intelligence analyzes HEAVYGRAM, a Telegram-based Windows backdoor attributed with moderate confidence to the Iran-linked threat actor Handala Hack. Active since Fall 2023, it has been used to surveil Iranian dissidents, journalists and government opponents, enabling remote command execution, data exfiltration, and persistence over Telegram command-and-control.

Publication date 16 September 2026