Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Group-IB attributes the Iran-linked hacktivist persona Handala (Void Manticore/MOIS) to the Telegram-based HEAVYGRAM backdoor and CRUDEEXCLUDE staging utility.
58
Malware
HEAVYGRAM
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 16, 2026
- Last mentionedSep 17, 2026
Timeline
4 articles · newest firstHandala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
68
Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware
Group-IB links HEAVYGRAM, a Telegram-based Windows surveillance backdoor targeting Iranian dissidents and journalists since 2023, to the Handala Hack group with moderate confidence.
65
Hackers Disguise CHOSEN BRICK Malware as AI Apps, Antivirus Software and MRI Results
NCSC, FBI, and AIVD warn Iranian state-linked actors deliver CHOSEN BRICK Windows spyware via fake AI apps, antivirus installers, and MRI-result lures.
72
Appears with
- Microsoft Defenderproduct · 3
- CRUDEEXCLUDEmalware · 3
- FBIorganization · 2
- Group-IBorganization · 2
- Handala Hackthreat actor · 2
- WhatsAppproduct · 2
- Microsoftvendor · 2
- Telegramvendor · 2
- Storm-0842threat actor · 2
- HEAVYGRAMproduct · 2
- CRUDEEXCLUDEproduct · 2
- Void Manticorethreat actor · 2
- UK NCSCvendor · 1
- Windowsproduct · 1
- Ministry of Intelligence and Securityorganization · 1
- CHOSEN BRICKmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.