HEAVYGRAM Backdoor Linked to Handala Hack Uses Telegram C2
Group-IB has linked the Iran-associated Handala Hack persona to HEAVYGRAM, a Python-based surveillance backdoor that uses Telegram for command-and-control. The implant can steal saved passwords, Telegram session files and browser data, capture screenshots, collect system information, transfer files and execute commands on compromised Windows systems.
The researchers also tied activity to CRUDEEXCLUDE, a Delphi-based Windows utility used to prepare victim environments for later malware stages, including HEAVYGRAM. First observed in late July 2024, CRUDEEXCLUDE often presents itself as a legitimate GUI application and configures Microsoft Defender exclusion paths to evade scanning.
Telegram becomes the command channel
HEAVYGRAM was first detected in the wild in September 2023. After execution, it prevents Defender from scanning directories used to stage malicious payloads and runs PowerShell code to establish Registry-based persistence for the next-stage implant.
Its Telegram-based control channel supports a broad set of surveillance and operational functions. Operators can list processes, take screenshots, activate the microphone, copy Telegram and WhatsApp data, download additional malware, remove files, upload or retrieve files, and collect browser data and stored credentials.
Group-IB described message prefixes used to activate functions. The @@ prefix can run arbitrary system commands through os.popen, while other commands can write a file, launch processes, update the bot token and operator identifier, install Registry autorun persistence, or exfiltrate Telegram Desktop data. The implant also sends an initial beacon containing the compromised host's full domain name and a health message every 24 hours.
Social engineering and staged delivery
The attacks typically begin with social engineering through Telegram, WhatsApp or Instagram. Victims may be approached by apparent technical-support contacts or people they trust, then persuaded to run a seemingly harmless installer. Known lures have impersonated Pictory, KeePass and Telegram while carrying the second-stage implant.
Group-IB identified four delivery methods: WSF or VBS scripts; VBScript and HTML Application files; executables containing embedded archives; and CRUDEEXCLUDE with embedded archives. Google documented CRUDEEXCLUDE in December 2025 as a tool that stages directories for HEAVYGRAM and SHADEGENES while masquerading as applications such as Pictory and Telegram.
The U.S. Federal Bureau of Investigation warned in March 2026, and again this week, that Iranian cyber actors acting for the Ministry of Intelligence and Security targeted Iranian dissidents, journalists opposed to Iran and other opposition groups for intelligence collection, data leaks and reputational harm. The U.K. National Cyber Security Centre tracks the same malware family as CHOSEN BRICK.
Operational implication for defenders
For businesses, the practical response is to treat unexpected support messages and familiar-looking installers as potential credential-theft attempts, monitor Defender exclusion changes and Registry autorun entries, and investigate Telegram activity that does not fit approved business use.