Security1 publisher2 min readPublished
Group-IB ties the Handala Hack persona to a Telegram-run backdoor that steals saved passwords
Group-IB says the Iran-linked leak-and-brag front Handala Hack runs HEAVYGRAM, a Python implant that takes orders from a Telegram bot, opens the microphone and lifts saved passwords after a loader writes Defender exclusions for it.
The Watch · Security desk
What happened
- Group-IB attributed the Iran-linked hacktivist persona Handala Hack to HEAVYGRAM, a Telegram-based surveillance backdoor, and to CRUDEEXCLUDE, a Delphi-based Windows utility that stages it.
- HEAVYGRAM is Python-based and takes orders over Telegram to list processes, grab screenshots and browser data, move files, turn on the microphone, copy Telegram and WhatsApp data and steal saved passwords.
- CRUDEEXCLUDE, first observed in late July 2024, poses as a legitimate application with a graphical interface and configures Microsoft Defender exclusion paths before later stages land.
- Operators approach targets on Telegram, WhatsApp and Instagram posing as technical support or trusted contacts, then send installers masquerading as Pictory, KeePass and Telegram that carry the second stage.
- The FBI issued an alert in March 2026 and reissued it this week, accusing MOIS-tasked Iranian actors of hitting dissidents, journalists and opposition groups to collect intelligence and leak data.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The people at the end of this chain are dissidents and journalists on personal machines with no endpoint telemetry, where the compromise is found by the victim.
- capability One implant serves both halves of the operation: a live microphone and saved credentials for collection, and the stolen files the persona later publishes against the same people.
- decision Alerting on Defender exclusion writes is a configuration change available to any Windows fleet, and it catches this chain one stage before the implant executes.
- constraint Anyone correlating the UK NCSC's CHOSEN BRICK write-up with Group-IB's HEAVYGRAM report has to reconcile two names for one family before the indicators line up.
Group-IB dates HEAVYGRAM's first detection in the wild to September 2023, weeks before the Handala Hack persona surfaced in the aftermath of the October 7, 2023 attacks [9][7][1]. The loader came later. CRUDEEXCLUDE was first observed in late July 2024, roughly ten months after the implant [3][2].
The order matters for detection. The loader ships as a Windows application with a graphical interface, and it configures Microsoft Defender exclusion paths for the directories staging the payloads. Then it executes PowerShell to set autorun registry persistence for the next stage [3][10]. On the host, that exclusion write is the first artifact the chain leaves [3]. The exclusion is in place before the implant runs.
HEAVYGRAM is Python and parses incoming Telegram bot messages on a prefix delimiter [11][12]. The prefix @@ runs arbitrary system commands through os.popen; ** writes the message body to C:\ProgramData\ur.txt; ## opens the backdoor suite [12]. That suite includes runexe to start a process and whois to pull the host's public IP from api.ipify[.]org. runtro runs a secondary trojan, cht swaps the C2 bot token and operator user ID mid-operation, regtro and reg write autorun keys, and dt exfiltrates Telegram Desktop data [13].
"HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said [2].
Two functions carry the traffic. "The persistent implant handles C2 communication via two functions," Group-IB said. By its account, send_initial_message transmits an initial connection beacon containing the full computer domain name of the compromised host, and send_health_msg is a background thread that sends a heartbeat message every 24 hours with the host's domain name, confirming that the implant remains active [14]. The heartbeat goes to Telegram once a day, on a machine whose owner was approached over Telegram in the first place [4].
The UK National Cyber Security Centre tracks the same family as CHOSEN BRICK and calls it a flexible tool that can "support a range of potential operational outcomes" [5].
Handala Hack is assessed to be an online persona operated by Void Manticore, also tracked as Banished Kitten, Red Sandstorm and Storm-0842. The actor is affiliated with Iran's Ministry of Intelligence and Security and has a record of destructive wiping and hack-and-leak operations [7]. Canada's Rapid Response Mechanism said last September that the actor targeted and doxxed five Iran International journalists, including one from Iran [8].
What to watch
- Whether Group-IB or the FBI publishes installer hashes and a victim count for the Pictory, KeePass and Telegram lures.
- Whether NCSC's CHOSEN BRICK reporting and Group-IB's HEAVYGRAM indicators are published against each other so defenders stop matching two names by hand.
- Whether the cht command's ability to rotate bot tokens and operator IDs shows up in fresh samples, which would blunt token-based blocking.