Threat actor

Handala Hack

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 17, 2026 · last 1h ago

Timeline2 articles

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.

Group-IB documented previously unreported HEAVYGRAM and CRUDEEXCLUDE malware linked with moderate confidence to the Iran-aligned Handala Hack, assessed as a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm). CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, then a Delphi-based loader deploys a PyInstaller-packaged HEAVYGRAM implant that abuses Telegram bot APIs for command-and-control, shell execution, screenshots, audio recording, and Telegram Desktop data theft. The campaign targets Iranian dissidents, journalists, and academics with fake KeePass, Telegram, WhatsApp, and Pictory installers. The DOJ seized four related domains in March 2026 and the FBI published a HEAVYGRAM FLASH report on September 15.

GBHackers13:46 UTC · 1h agoThreat actor in the wild 9 sources

Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware

Group-IB links HEAVYGRAM, a Telegram-based Windows surveillance backdoor targeting Iranian dissidents and journalists since 2023, to the Handala Hack group with moderate confidence.

Group-IB identified 29 additional HEAVYGRAM samples, loaders, and payloads and linked the operation to Handala Hack with moderate confidence, expanding on US government disclosures. The backdoor has targeted journalists, Iranian dissidents, and government opponents since fall 2023, including a journalist at a UK-based Farsi-language outlet and a US-based victim. It collects screenshots and audio, steals Telegram Desktop data, executes commands, and persists via Windows registry entries, with associated CRUDEEXCLUDE samples adding security exclusions before delivery.

Cyber Security Newsupdated 13:46 UTC · 1h agofirst 12:53 UTC · 2h agoMalware in the wild 9 sources

Appears with

malware CRUDEEXCLUDE 2 organization Group-IB 2 malware HEAVYGRAM 2 vendor Telegram 2 threat actor Void Manticore 1 organization FBI 1 organization Ministry of Intelligence and Security (MOIS) 1 threat actor Banished Kitten 1 product CRUDEEXCLUDE 1 product HEAVYGRAM 1 product KeePass 1 product Microsoft Defender 1 product Pictory 1 product Telegram Desktop 1 product WhatsApp 1 vendor Microsoft 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.