Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Group-IB attributes the Iran-linked hacktivist persona Handala (Void Manticore/MOIS) to the Telegram-based HEAVYGRAM backdoor and CRUDEEXCLUDE staging utility.
58
Threat actor
Void Manticore
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 17, 2026
- Last mentionedSep 17, 2026
Timeline
2 articles · newest firstHandala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
68
Appears with
- HEAVYGRAMmalware · 2
- CRUDEEXCLUDEmalware · 2
- Storm-0842threat actor · 2
- Microsoft Defenderproduct · 2
- HEAVYGRAMproduct · 1
- Group-IBvendor · 1
- Handalathreat actor · 1
- Banished Kittenthreat actor · 1
- Handala Hackthreat actor · 1
- KeePassproduct · 1
- FBIvendor · 1
- Ministry of Intelligence and Security (MOIS)organization · 1
- FBIorganization · 1
- US Department of Justiceorganization · 1
- Microsoftvendor · 1
- WhatsAppproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.