Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Group-IB attributes the Iran-linked hacktivist persona Handala (Void Manticore/MOIS) to the Telegram-based HEAVYGRAM backdoor and CRUDEEXCLUDE staging utility.
2
Stories per day · 30 days
2 RSS
7 stories, newest first · one card per story
Stories tagged #mois
Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Group-IB links new HEAVYGRAM and CRUDEEXCLUDE malware to Iran-aligned Handala Hack (MOIS/Void Manticore), which spies on Iranian dissidents using Defender exclusions and Telegram C2.
3
Iranian Hackers Use Telegram-Controlled Malware to Spy on Dissidents and Journalists
FBI, NCSC, and AIVD detail Iran MOIS spyware CHOSEN BRICK/HEAVYGRAM, Telegram-controlled Windows malware spying on dissidents since 2023.
3
Iranian cyber spies used fake MRI scan results to hack ‘enemy of regime’
UK, US, and Dutch agencies expose CHOSEN BRICK spyware used by Iranian MOIS hackers to surveil dissidents, journalists, and activists via fake MRI lures.
2
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.
1
Treasury sanctions alleged Iranian hackers as part of ‘economic D
US Treasury sanctioned four Iranians linked to MOIS-directed hacks that compromised and exfiltrated data from US critical infrastructure, energy, defense, and financial targets.
2
US sanctions Iranian cyber actors as UK discloses power plant attack
US Treasury sanctioned six Iranian MOIS-linked hackers for breaching US agency and UN email accounts as the UK disclosed a four-day power plant shutdown.
1