Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
Iran-linked threat actor Handala Hack is utilizing the Telegram-based backdoor HEAVYGRAM to conduct surveillance and intelligence gathering operations targeting Iranian dissidents, journalists, and opposition groups. The tool, developed and operated by Void Manticore (affiliated with Iran's MOIS), employs a multi-stage infection chain involving application masquerading, defense evasion, and persistent access, leveraging Telegram for command and control. The U.K. National Cyber Security Center tracks this activity under the moniker CHOSEN BRICK.
The Iran-linked threat actor known as Handala Hack is leveraging a Telegram-based backdoor called HEAVYGRAM to conduct intelligence collection and leak operations against Iranian dissidents, journalists opposed to Iran, and other opposition groups. This activity is attributed to Void Manticore (also known as Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor linked to Iran's Ministry of Intelligence and Security (MOIS).
HEAVYGRAM offers a suite of built-in commands, including remote command execution, system and network information discovery, data and Telegram session file exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys. The tool is delivered through various methods, including WSF/VBS scripts, VBScripts and HTML Application (HTA) files, executables with embedded archives, and CRUDEEXCLUDE, a Delphi-based Windows utility used to prepare environments for HEAVYGRAM and another malware family named SHADEGENES. CRUDEEXCLUDE masquerades as legitimate applications like Pictory and Telegram to evade detection.
Incoming messages from the Telegram bot are parsed based on a prefix system: `@@` to execute arbitrary system commands, `**` to write the message body to a file, and `##` to enable a backdoor command suite with capabilities like `runexe` (start an arbitrary process), `whois` (retrieve the host's public IP address), `runtro` (execute a secondary trojan payload), `cht` (dynamically update the C2 Telegram bot token), `regtro` (install a trojan payload into Windows autorun Registry keys), `reg` (install the main malware executable into Windows autorun registry keys), and `dt` (exfiltrate Telegram Desktop application data).
Incoming attachments are handled based on filename pattern matching. The persistent implant handles C2 communication via two functions: `send_initial_message` (transmits an initial connection beacon) and `send_health_msg` (a background thread that sends a heartbeat message every 24 hours). The Telegram infrastructure utilizes two setups: one with a single bot handling check-ins and a secondary bot managing logging and stage polling, and another with one bot handling check-ins and a secondary bot managing logging and stage polling.
The Canadian Rapid Response Mechanism (RRM) has previously flagged Handala Hack for targeting and doxxing five Iran International journalists. The extensive use of Telegram as a command-and-control channel is notable, providing operators with a natively encrypted channel with low setup and maintenance costs.