Iran-Linked Handala Hack Deploys HEAVYGRAM Backdoor in Surveillance Campaign
A cyber threat group tied to Iran’s Ministry of Intelligence and Security (MOIS), operating under the "Handala Hack" persona, has been linked to a sophisticated surveillance campaign leveraging the HEAVYGRAM backdoor and the CRUDEEXCLUDE utility. The activity, first observed in September 2023, targets Iranian dissidents, journalists, and opposition groups through social engineering tactics on platforms like Telegram, WhatsApp, and Instagram.
Key Tools and Tactics
- HEAVYGRAM: A Python-based backdoor with built-in commands for remote execution, data exfiltration, persistence via Windows autorun keys, and Telegram session theft. It uses Telegram as a command-and-control (C2) channel, enabling operators to execute system commands, capture screenshots, steal browser data, and deploy additional malware. The malware employs a prefix-based system (e.g.,
@@for command execution,##for backdoor functions) to parse bot messages and handle attachments. - CRUDEEXCLUDE: A Delphi-based utility first detected in July 2024, designed to prepare systems for HEAVYGRAM deployment by configuring Microsoft Defender exclusions and masquerading as legitimate applications (e.g., Pictory, KeePass, Telegram). It was previously documented by Google in December 2025 as part of a multi-stage infection chain.
Infection Chain and Persistence
HEAVYGRAM is delivered via WSF/VBS scripts, HTA files, or executables with embedded archives, often disguised as trusted software. Once executed, it:
- Evades detection by excluding malicious paths from Defender scans.
- Establishes persistence via Windows Registry autorun keys.
- Exfiltrates data (e.g., Telegram/WhatsApp sessions, saved passwords) and maintains 24-hour heartbeat check-ins with its C2 bot.
The malware’s Telegram-based C2 infrastructure operates in two configurations: a single bot/group setup or a dual-bot system for check-ins and logging.
Attribution and Impact
Handala Hack, active since October 2023, is attributed to Void Manticore (aka Banished Kitten, Red Sandstorm), a MOIS-affiliated group known for destructive wiping attacks and hack-and-leak operations. The U.S. FBI and UK’s NCSC (tracking the malware as CHOSEN BRICK) have warned of its use in intelligence collection and reputational harm against Iranian opposition figures.
In September 2023, Canada’s Rapid Response Mechanism (RRM) reported the group’s targeting of Iran International journalists in a doxxing campaign. The latest findings, published by Group-IB, highlight the threat’s flexible, multi-stage infection chain, combining social engineering, defense evasion, and persistent access to compromise high-value targets.
Source: https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html
Ministry of Information and Communications Technology of Iran cybersecurity rating report: https://www.rankiteo.com/company/ministry-of-information-and-communications-technology-of-iran
"id": "MIN1789655035",
"linkid": "ministry-of-information-and-communications-technology-of-iran",
"type": "Cyber Attack",
"date": "7/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'location': 'Iran',
'name': 'Iranian dissidents',
'type': 'Individuals'},
{'industry': 'Media',
'location': 'Global (targeted in Iran and abroad)',
'name': 'Journalists',
'type': 'Individuals'},
{'industry': 'Political Activism',
'location': 'Iran',
'name': 'Opposition groups',
'type': 'Organizations'},
{'industry': 'Media',
'location': 'Canada',
'name': 'Iran International',
'type': 'Organization'}],
'attack_vector': ['Social Engineering', 'Malware Deployment'],
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (Personally Identifiable '
'Information, Communication Logs)',
'type_of_data_compromised': ['Telegram/WhatsApp sessions',
'Browser data',
'Saved passwords']},
'date_detected': '2023-09-01',
'date_publicly_disclosed': '2024-07-01',
'description': 'A cyber threat group tied to Iran’s Ministry of Intelligence '
"and Security (MOIS), operating under the 'Handala Hack' "
'persona, has been linked to a sophisticated surveillance '
'campaign leveraging the HEAVYGRAM backdoor and the '
'CRUDEEXCLUDE utility. The activity targets Iranian '
'dissidents, journalists, and opposition groups through social '
'engineering tactics on platforms like Telegram, WhatsApp, and '
'Instagram.',
'impact': {'brand_reputation_impact': 'Reputational harm to targeted '
'individuals and organizations',
'data_compromised': ['Telegram/WhatsApp sessions',
'Saved passwords',
'Browser data'],
'identity_theft_risk': 'High (PII exposure)',
'operational_impact': 'Persistent unauthorized access and data '
'exfiltration',
'systems_affected': ['Windows systems']},
'initial_access_broker': {'backdoors_established': 'HEAVYGRAM',
'entry_point': ['Telegram', 'WhatsApp', 'Instagram'],
'high_value_targets': ['Journalists',
'Dissidents',
'Opposition Groups']},
'investigation_status': 'Ongoing',
'motivation': ['Intelligence Collection', 'Reputational Harm'],
'post_incident_analysis': {'root_causes': ['Social engineering',
'Defense evasion via CRUDEEXCLUDE',
'Persistent backdoor access']},
'references': [{'source': 'Group-IB'},
{'date_accessed': '2025-12-01', 'source': 'Google'},
{'date_accessed': '2023-09-01',
'source': 'Canada’s Rapid Response Mechanism (RRM)'},
{'source': 'FBI/UK’s NCSC'}],
'response': {'law_enforcement_notified': ['FBI', 'UK’s NCSC']},
'threat_actor': 'Handala Hack (Void Manticore, Banished Kitten, Red '
'Sandstorm)',
'title': 'Iran-Linked Handala Hack Deploys HEAVYGRAM Backdoor in Surveillance '
'Campaign',
'type': 'Surveillance Campaign'}