Ministry of Intelligence and Security (MOIS)

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenSep 17, 2026
Last mentionedSep 17, 2026

Timeline

1 articles · newest first

Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.

GBHackersSep 17, 13:46 UTC · Sep 17, 2026Threat actorExploited2

Appears with

Pictoryproduct · 1
CRUDEEXCLUDEmalware · 1
Red Sandstormthreat actor · 1
Group-IBorganization · 1
Telegramvendor · 1
Void Manticorethreat actor · 1
HEAVYGRAMmalware · 1
Banished Kittenthreat actor · 1
Handala Hackthreat actor · 1
KeePassproduct · 1
Microsoft Defenderproduct · 1
FBIorganization · 1
US Department of Justiceorganization · 1
Microsoftvendor · 1
WhatsAppproduct · 1
Telegram Desktopproduct · 1

Entities are extracted by the model from each article. First seen Sep 17, 2026, last mentioned Sep 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.