Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
Group-IB documented previously unreported HEAVYGRAM and CRUDEEXCLUDE malware linked with moderate confidence to the Iran-aligned Handala Hack, assessed as a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm). CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, then a Delphi-based loader deploys a PyInstaller-packaged HEAVYGRAM implant that abuses Telegram bot APIs for command-and-control, shell execution, screenshots, audio recording, and Telegram Desktop data theft. The campaign targets Iranian dissidents, journalists, and academics with fake KeePass, Telegram, WhatsApp, and Pictory installers. The DOJ seized four related domains in March 2026 and the FBI published a HEAVYGRAM FLASH report on September 15.
- CRUDEEXCLUDE uses PowerShell to add attacker-controlled Microsoft Defender exclusions, preventing scanning of planted directories.
- HEAVYGRAM is a PyInstaller-packaged Python implant using the Telegram bot API for C2, shell commands, screenshots, and data theft.
- Lures impersonated KeePass, Telegram, WhatsApp, and Pictory installers targeting Iranian dissidents, journalists, and academics.
- Group-IB assesses Handala Hack is a MOIS-linked persona tied to Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm).
- DOJ seized four Handala domains in March; FBI published a HEAVYGRAM FLASH report on September 15.
- ATT&CK
- T1562.001 Impair Defenses: Disable or Modify ToolsT1204.002 User Execution: Malicious FileT1102.002 Bidirectional CommunicationT1547.001 Registry Run Keys / Startup FolderT1574.002 DLL Side-Loading
- Malware
- HEAVYGRAMCRUDEEXCLUDE
- Countries
- Iran
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | handala-hack.to | ological operations and transnational repression, including Handala-Hack[.]to and Handala-Redwanted[.]to. The DOJ affidavit described “ |
| domain | handala-redwanted.to | d transnational repression, including Handala-Hack[.]to and Handala-Redwanted[.]to. The DOJ affidavit described “Heavygram” in incidents inv |
| md5 | 16602375fc2dae1eb54580ab7eda6567 | 0e9e9bdf32307c377e 9108466c98df01033371483a789a0c23372c52f2 16602375fc2dae1eb54580ab7eda6567 Encrypted text artefact 3befcca381deb6b492aa0c4eba222c29a25 |
| md5 | 7d3cce1f9dbaed585b61e6e903d69b9b | 15798c4754a4b74e81 53d41445e176bf53c5acd2dad533eda612b05855 7d3cce1f9dbaed585b61e6e903d69b9b Note: IP addresses and domains are intentionally defanged ( |
| md5 | b2f6f40570ac9085b5463fdb623560de | ff173368f848825de4 88a8d118ee190ac36cf684c2992f6ddd2dda517b b2f6f40570ac9085b5463fdb623560de Implant/Backdoor d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637e |
| md5 | b3c1a3eebefafe1346c6a864b5423182 | 7e2fa1d82d617f26dd 0190940243f6535f51d43edafac943d493159e14 b3c1a3eebefafe1346c6a864b5423182 RAR artefact 47fa634b13b8ba35bd5669da3059a0c7577911c16584a2 |
| sha1 | 0190940243f6535f51d43edafac943d493159e14 | 53084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd 0190940243f6535f51d43edafac943d493159e14 b3c1a3eebefafe1346c6a864b5423182 RAR artefact 47fa634b13b8b |
| sha1 | 53d41445e176bf53c5acd2dad533eda612b05855 | ca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81 53d41445e176bf53c5acd2dad533eda612b05855 7d3cce1f9dbaed585b61e6e903d69b9b Note: IP addresses and dom |
| sha1 | 88a8d118ee190ac36cf684c2992f6ddd2dda517b | 34b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4 88a8d118ee190ac36cf684c2992f6ddd2dda517b b2f6f40570ac9085b5463fdb623560de Implant/Backdoor d2d19c7f2 |
| sha1 | 9108466c98df01033371483a789a0c23372c52f2 | c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e 9108466c98df01033371483a789a0c23372c52f2 16602375fc2dae1eb54580ab7eda6567 Encrypted text artefact 3b |
| sha256 | 3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81 | f2 16602375fc2dae1eb54580ab7eda6567 Encrypted text artefact 3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81 53d41445e176bf53c5acd2dad533eda612b05855 7d3cce1f9dbaed585b |
| sha256 | 47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4 | 943d493159e14 b3c1a3eebefafe1346c6a864b5423182 RAR artefact 47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4 88a8d118ee190ac36cf684c2992f6ddd2dda517b b2f6f40570ac9085b5 |
| sha256 | 8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd | st effective defense. IOCs Type SHA256 SHA1 MD5 First stage 8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd 0190940243f6535f51d43edafac943d493159e14 b3c1a3eebefafe1346 |
| sha256 | d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e | d2dda517b b2f6f40570ac9085b5463fdb623560de Implant/Backdoor d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e 9108466c98df01033371483a789a0c23372c52f2 16602375fc2dae1eb5 |
From the original article
4 min read at gbhackers.com
A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation. The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people perceived as opponents of the Iranian government.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.