# The HEAVYGRAM Telegram Backdoor: How Handala Hack Weaponizes Chat Apps

> Discover how the Iran-linked Handala Hack uses the HEAVYGRAM Telegram backdoor and CRUDEEXCLUDE to steal passwords and evade Microsoft Defender.

- Canonical URL: https://coreiten.com/en/article/the-heavygram-telegram-backdoor-how-handala-hack-weaponizes-chat-apps
- Language: en
- Section: Telegram
- Author: Sami
- Published: 2026-09-21T18:03:54+03:00
- Modified: 2026-09-21T18:03:54+03:00
- Publisher: CoreITen (https://coreiten.com)
- Keywords: HEAVYGRAM, Handala Hack, CRUDEEXCLUDE, Void Manticore, Telegram C2, Microsoft Defender

## Summary

The HEAVYGRAM Telegram backdoor campaign weaponizes chat apps to target journalists and dissidents, orchestrated by the Iran-linked Handala Hack persona.

- Handala Hack is assessed to be operated by Void Manticore, a threat actor also linked to Iran's Ministry of Intelligence and Security.
- The FBI issued alerts in March 2026 and this week warning that these actors target Iranian dissidents for intelligence collection and reputational harm.
- The infection chain begins with CRUDEEXCLUDE, a Delphi-based Windows utility first observed in late July 2024.
- HEAVYGRAM is delivered through four distinct methods, including WSF/VBS scripts, HTA files, executables with embedded archives, and CRUDEEXCLUDE.
- The U.K. National Cyber Security Center tracks this same malware family under the moniker CHOSEN BRICK.
- HEAVYGRAM uses Telegram as its command-and-control infrastructure, routing malicious traffic through the globally trusted messaging platform.

**Why it matters:** This campaign highlights how state-sponsored threat actors leverage legitimate, widely used messaging applications to bypass traditional perimeter defenses and reduce operational costs.

---

The HEAVYGRAM Telegram backdoor is actively targeting journalists and dissidents through a sophisticated surveillance campaign that turns the popular messaging app into a weaponized command center. Security professionals and at-risk individuals must understand the mechanics of this multi-stage infection to protect sensitive data from exfiltration. This campaign is attributed to the Iran-linked Handala Hack persona, which emerged shortly after the October 7, 2023, armed attacks by Hamas and other Palestinian militant groups.

Handala Hack is assessed to be operated by Void Manticore, a threat actor also known as Banished Kitten, Red Sandstorm, and Storm-0842. The group is affiliated with Iran's Ministry of Intelligence and Security (MOIS). The U.S. Federal Bureau of Investigation (FBI) issued alerts in March 2026 and again this week, warning that these actors are targeting Iranian dissidents and opposition groups to conduct intelligence collection and inflict reputational harm. Last September, the Canadian Rapid Response Mechanism (RRM) reported that the group targeted five Iran International journalists in a hack-and-leak operation.

### The CRUDEEXCLUDE and HEAVYGRAM Infection Chain

The attacks rely heavily on social engineering via platforms like Telegram, WhatsApp, and Instagram, where operators pose as trusted contacts offering technical support. The infection begins with CRUDEEXCLUDE, a Delphi-based Windows utility first observed in late July 2024. This tool prepares the environment by configuring Microsoft Defender exclusion paths for defense evasion. Google previously documented CRUDEEXCLUDE in December 2025, noting its use in setting up staging directories for HEAVYGRAM and another malware family named SHADEGENES.

Once the environment is prepared, the Python-based HEAVYGRAM backdoor - first detected in the wild in September 2023 - is deployed. The malware executes PowerShell code to establish persistence via Windows autorun registry keys. HEAVYGRAM is delivered through four distinct methods: WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE itself. These payloads masquerade as legitimate applications like Pictory, KeePass, and Telegram.

The U.K. National Cyber Security Center (NCSC) tracks this same malware family under the moniker CHOSEN BRICK. The persistent implant handles command-and-control (C2) communication via two specific functions. The first transmits an initial connection beacon containing the full computer domain name:

```text
send_initial_message
```

The second is a background thread that sends a heartbeat message every 24 hours to confirm the implant remains active:

```text
send_health_msg
```

### Telegram Bot Command Execution

HEAVYGRAM uses Telegram as its C2 infrastructure, parsing incoming messages from a bot based on a strict prefix delimiter system. Prefix @@ executes arbitrary system commands via:

```python
os.popen
```

Prefix ** writes the message body directly to:

```text
C:\ProgramData\ur.txt
```

Prefix ## enables a comprehensive backdoor command suite that supports the following capabilities:

- Start an arbitrary process on the host:

```text
runexe
```

- Retrieve the host's public IP address via api.ipify[.]org:

```text
whois
```

- Execute a secondary trojan payload:

```text
runtro
```

- Dynamically update the C2 Telegram bot token and operator user ID:

```text
cht
```

- Install the trojan payload into Windows autorun Registry keys:

```text
regtro
```

- Install the main malware executable into Windows autorun registry keys:

```text
reg
```

- Exfiltrate Telegram Desktop application data:

```text
dt
```

> The newly identified samples demonstrate a flexible, multi-stage infection chain in which operators combine tailored social engineering, application masquerading, defense evasion and persistent access to compromise targets of interest.
>
>  - Group-IB

### The Invisible C2 Infrastructure

The reliance on Telegram for command-and-control operations represents a critical shift in how state-sponsored actors manage their infrastructure. By routing malicious traffic through a globally trusted, natively encrypted messaging platform, Void Manticore effectively neutralizes traditional network perimeter defenses. Security teams looking for anomalous outbound connections will simply see standard Telegram API traffic, which is rarely blocked in enterprise or personal environments.

Furthermore, this approach drops the operational cost for the attackers to zero. Instead of purchasing and rotating bulletproof hosting servers, they leverage Telegram bots that can be dynamically updated using the cht command. As highlighted by the FBI and UK NCSC alerts, defending against tools like HEAVYGRAM requires shifting focus from network blocking to endpoint behavioral analysis, specifically monitoring for unauthorized DLL sideloading and unexpected modifications to Windows autorun registry keys.

## Sources

- [thehackernews.com](https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html)