Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Group-IB attributes the Iran-linked hacktivist persona Handala (Void Manticore/MOIS) to the Telegram-based HEAVYGRAM backdoor and CRUDEEXCLUDE staging utility.
58
Malware
SHADEGENES
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenSep 17, 2026
- Last mentionedSep 17, 2026
Timeline
1 articles · newest firstAppears with
- CRUDEEXCLUDEmalware · 1
- HEAVYGRAMproduct · 1
- UK NCSCvendor · 1
- Void Manticorethreat actor · 1
- Ministry of Intelligence and Securityorganization · 1
- HEAVYGRAMmalware · 1
- Group-IBvendor · 1
- Handalathreat actor · 1
- Storm-0842threat actor · 1
- CRUDEEXCLUDEproduct · 1
- FBIvendor · 1
- Microsoft Defenderproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.