Group-IB ties the Handala Hack persona to a Telegram-run backdoor that steals saved passwords

Attacks typically use social engineering over Telegram, WhatsApp and Instagram, with operators posing as technical support or trusted contacts, then delivering malware dressed as harmless installers masquerading as legitimate applications including Pictory, KeePass and Telegram, which contain the second-stage implant.

"HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said.

The FBI first issued an alert in March 2026, and again earlier this week, accusing Iranian cyber actors acting on behalf of the Ministry of Intelligence and Security of targeting Iranian dissidents, journalists opposed to Iran and other opposition groups to conduct intelligence collection, leak data and inflict reputational harm.

Group-IB attributed the Iran-linked "hacktivist" persona Handala Hack to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE.

CRUDEEXCLUDE is a Delphi-based Windows utility used to prepare environments for later stages such as HEAVYGRAM; first observed in late July 2024, it is often disguised as a legitimate application with a graphical user interface and configures Microsoft Defender exclusion paths for defense evasion.

Handala Hack came into being shortly after the October 7, 2023 attacks on southern Israel and is assessed to be an online persona operated by Void Manticore (aka Banished Kitten, Red Sandstorm, Storm-0842), a threat actor affiliated with Iran's MOIS with a history of destructive wiping attacks and hack-and-leak operations.

In an alert issued last September, the Canadian Rapid Response Mechanism said the threat actor targeted and doxxed five Iran International journalists, including one from Iran, as part of a hack-and-leak operation.

According to Group-IB, HEAVYGRAM was first detected in the wild in September 2023.

Incoming messages from the Telegram bot are parsed on a prefix delimiter system: @@ executes arbitrary system commands via os.popen, ** writes the message body to C:\ProgramData\ur.txt, and ## enables a backdoor command suite.

The backdoor command suite includes runexe (start an arbitrary process), whois (retrieve the host's public IP via api.ipify[.]org), runtro (execute a secondary trojan payload), cht (dynamically update the C2 Telegram bot token and operator user ID), regtro and reg (install payload and main executable into Windows autorun registry keys) and dt (exfiltrate Telegram Desktop application data).

"The persistent implant handles C2 communication via two functions: send_initial_message - transmits an initial connection beacon containing the full computer domain name of the compromised host, [and] send_health_msg - a background thread that sends a heartbeat message every 24 hours with the host's domain name, confirming that the implant remains active," Group-IB said.

HEAVYGRAM was in use before the Handala Hack persona existed: first detection was September 2023, and the persona appeared only after the October 7, 2023 attacks.

CRUDEEXCLUDE was first observed roughly ten months after HEAVYGRAM's first detection.

In the sequence Group-IB describes, the Defender exclusion path is configured before the implant executes, so the exclusion-list write is the earliest host-side artifact in the chain.

The implant's heartbeat is one outbound message per host per day, and it goes to the same platform operators used to approach the target.