Iran's Handala Group Blinds Defender Then Plants HEAVYGRAM, a Telegram-Controlled Backdoor

Iran-linked Handala Hack is blinding Microsoft Defender on a target machine, then planting a Telegram-controlled backdoor.

Group-IB ties the crew to a Delphi loader called CRUDEEXCLUDE that adds Defender exclusions before launching HEAVYGRAM, a Windows surveillance implant, The Hacker News reported. An FBI HEAVYGRAM FLASH expansion on 15 September and Department of Justice domain seizures on 19 March sit behind that research. Group-IB did not publish a product CVE or a confirmed list of named corporate victims. The newly linked samples sit at moderate confidence.

Group-IB assesses the Handala Hack persona as an online front for Void Manticore, also tracked as Storm-0842, Banished Kitten, and Red Sandstorm, and affiliated with Iran's Ministry of Intelligence and Security. The FBI attributes HEAVYGRAM operations to actors working for that ministry.

CRUDEEXCLUDE is a Delphi first-stage loader with a graphical interface, often masquerading as Pictory, Telegram, KeePass, or WhatsApp. It uses PowerShell to add attacker-controlled paths to Microsoft Defender exclusions so later payloads in those paths are not scanned. It then decodes an embedded archive to a ZIP under C:\ProgramData and launches HEAVYGRAM with CreateProcessW. The loader was first observed in late July 2024.

HEAVYGRAM is a Windows surveillance implant, often packaged with PyInstaller. It talks to operators over Telegram using hardcoded bot credentials. Reported capabilities include a remote shell, screenshots, browser and password theft, Telegram Desktop and WhatsApp data theft, microphone recording, and persistence.

Incoming Telegram commands are parsed by prefix. @@ runs a shell via os.popen, ** writes the message body to C:\ProgramData\ur.txt, and ## opens a backdoor suite for extra payloads, autorun keys, and Telegram Desktop theft. A background thread sends a heartbeat every 24 hours with the compromised host's domain name.

Targets in this reporting are Iranian dissidents, journalists, and opposition figures, reached through social engineering on Telegram, WhatsApp, and Instagram. The UK National Cyber Security Centre tracks related malware as CHOSEN BRICK. That label and the US HEAVYGRAM name cover overlapping activity, which is why the joint advisory on Iran's Chosen Brick spyware is the same campaign under a second name, not a second crew.

Some offers on this page may be paid placements or contain affiliate links.