The HEAVYGRAM Telegram Backdoor: How Handala Hack Weaponizes Chat Apps

The HEAVYGRAM Telegram backdoor is actively targeting journalists and dissidents through a sophisticated surveillance campaign that turns the popular messaging app into a weaponized command center. Security professionals and at-risk individuals must understand the mechanics of this multi-stage infection to protect sensitive data from exfiltration. This campaign is attributed to the Iran-linked Handala Hack persona, which emerged shortly after the October 7, 2023, armed attacks by Hamas and other Palestinian militant groups.

Handala Hack is assessed to be operated by Void Manticore, a threat actor also known as Banished Kitten, Red Sandstorm, and Storm-0842. The group is affiliated with Iran's Ministry of Intelligence and Security (MOIS). The U.S. Federal Bureau of Investigation (FBI) issued alerts in March 2026 and again this week, warning that these actors are targeting Iranian dissidents and opposition groups to conduct intelligence collection and inflict reputational harm. Last September, the Canadian Rapid Response Mechanism (RRM) reported that the group targeted five Iran International journalists in a hack-and-leak operation.

The attacks rely heavily on social engineering via platforms like Telegram, WhatsApp, and Instagram, where operators pose as trusted contacts offering technical support. The infection begins with CRUDEEXCLUDE, a Delphi-based Windows utility first observed in late July 2024. This tool prepares the environment by configuring Microsoft Defender exclusion paths for defense evasion. Google previously documented CRUDEEXCLUDE in December 2025, noting its use in setting up staging directories for HEAVYGRAM and another malware family named SHADEGENES.

Once the environment is prepared, the Python-based HEAVYGRAM backdoor - first detected in the wild in September 2023 - is deployed. The malware executes PowerShell code to establish persistence via Windows autorun registry keys. HEAVYGRAM is delivered through four distinct methods: WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE itself. These payloads masquerade as legitimate applications like Pictory, KeePass, and Telegram.

The U.K. National Cyber Security Center (NCSC) tracks this same malware family under the moniker CHOSEN BRICK. The persistent implant handles command-and-control (C2) communication via two specific functions. The first transmits an initial connection beacon containing the full computer domain name:

send_initial_message

The second is a background thread that sends a heartbeat message every 24 hours to confirm the implant remains active:

send_health_msg

HEAVYGRAM uses Telegram as its C2 infrastructure, parsing incoming messages from a bot based on a strict prefix delimiter system. Prefix @@ executes arbitrary system commands via:

os.popen

Prefix ** writes the message body directly to:

C:\ProgramData\ur.txt

Prefix ## enables a comprehensive backdoor command suite that supports the following capabilities:

• Start an arbitrary process on the host:

runexe

Retrieve the host's public IP address via api.ipify[.]org:

whois

Execute a secondary trojan payload:

runtro

Dynamically update the C2 Telegram bot token and operator user ID:

cht

Install the trojan payload into Windows autorun Registry keys:

regtro

Install the main malware executable into Windows autorun registry keys:

reg

Exfiltrate Telegram Desktop application data:

dt

The newly identified samples demonstrate a flexible, multi-stage infection chain in which operators combine tailored social engineering, application masquerading, defense evasion and persistent access to compromise targets of interest.

- Group-IB

The reliance on Telegram for command-and-control operations represents a critical shift in how state-sponsored actors manage their infrastructure. By routing malicious traffic through a globally trusted, natively encrypted messaging platform, Void Manticore effectively neutralizes traditional network perimeter defenses. Security teams looking for anomalous outbound connections will simply see standard Telegram API traffic, which is rarely blocked in enterprise or personal environments.

Furthermore, this approach drops the operational cost for the attackers to zero. Instead of purchasing and rotating bulletproof hosting servers, they leverage Telegram bots that can be dynamically updated using the cht command. As highlighted by the FBI and UK NCSC alerts, defending against tools like HEAVYGRAM requires shifting focus from network blocking to endpoint behavioral analysis, specifically monitoring for unauthorized DLL sideloading and unexpected modifications to Windows autorun registry keys.