"HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading, file cleanup, and persistence via Windows autorun registry keys," Group-IB said.
Group-IB’s HEAVYGRAM analysis: a multi-capable Telegram backdoor
Group-IB’s forensic review ties the Iran-linked "hacktivist" persona Handala Hack to a Python-based Telegram backdoor the firm calls HEAVYGRAM. First detected in the wild in September 2023, HEAVYGRAM uses Telegram for command-and-control (C2) and supports a broad set of espionage capabilities: listing running programs, taking screenshots, capturing web browser data, uploading and downloading files, activating the microphone, copying Telegram and WhatsApp data, stealing saved passwords, loading additional malware and deleting files.
The implant enforces persistence via Windows autorun registry keys and evades detection by preventing Microsoft Defender from scanning staging paths and by executing PowerShell to install the next-stage implant. Group-IB also described two persistent C2 functions: send_initial_message, which sends a connection beacon containing the host’s full computer domain name, and send_health_msg, a heartbeat sent every 24 hours confirming continued activity.
Telegram C2 and the command prefix system
HEAVYGRAM parses incoming Telegram bot messages using a prefix delimiter system that lets operators deliver arbitrary commands and staged instructions. The observed prefixes include:
- @@ — execute arbitrary system commands via os.popen
- ** — write the message body to C:\ProgramData\ur.txt
- ## — enable a backdoor command suite that supports a set of labeled subcommands
The ## subcommands observed by Group-IB include runexe (start an arbitrary process), whois (retrieve the host's public IP via api.ipify[.]org), runtro (execute a secondary trojan payload), cht (update the C2 Telegram bot token and operator user ID), regtro (install a trojan payload into Windows autorun keys), reg (install the main executable into autorun keys) and dt (exfiltrate Telegram Desktop application data). Group-IB also noted that attachments sent via the Telegram bot are processed based on filename pattern matching.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCRUDEEXCLUDE and the staging chain
Group-IB links HEAVYGRAM deployment to a Delphi-based utility called CRUDEEXCLUDE, first observed in late July 2024. CRUDEEXCLUDE is used to prepare environments for HEAVYGRAM staging and is typically disguised as a legitimate application with a graphical user interface. The utility configures Microsoft Defender exclusion paths to evade detection.
Google documented CRUDEEXCLUDE in December 2025 as setting up staging directories for HEAVYGRAM and another payload family called SHADEGENES. HEAVYGRAM has been delivered through at least four methods: WSF/VBS scripts; VBScript and HTML Application (HTA) files; executables with embedded archives; and CRUDEEXCLUDE bundles that contain embedded archives. Operators frequently masquerade payloads as familiar software — Group-IB observed decoys posing as Pictory, KeePass and Telegram, among others.
Attribution, allied alerts, and tracking names
Group-IB and other analysts link the Handala Hack persona to an operator known as Void Manticore (also referenced as Banished Kitten, Red Sandstorm and Storm-0842) and assess that this actor is affiliated with Iran's Ministry of Intelligence and Security (MOIS). The persona emerged shortly after the October 7, 2023 armed attacks by Hamas and other Palestinian militant groups targeting southern Israel and has a record of destructive wiping and hack-and-leak operations.
The U.S. Federal Bureau of Investigation issued alerts in March 2026 and again earlier this week accusing Iranian cyber actors acting on behalf of MOIS of targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups for intelligence collection, leak operations and reputational harm. The U.K. National Cyber Security Center is tracking the same malware family under the name CHOSEN BRICK, describing it as a flexible tool that can support a range of operational outcomes. In an alert last September, the Canadian Rapid Response Mechanism called out the threat actor for targeting and doxxing five Iran International journalists as part of a hack-and-leak campaign.
What this means for technologists, policymakers, and affected journalists
- Technologists and security teams: Expect a multi-stage infection chain that blends social engineering on messaging apps with executable masquerading and Defender-exclusion setup via CRUDEEXCLUDE. Detection efforts should focus on suspicious HTA/WSF/VBS activity, unexpected autorun registry writes, and anomalous Telegram bot traffic patterns consistent with the prefix-delimited commands and heartbeat messaging described by Group-IB.
- Policymakers and law enforcement: The FBI’s repeated alerts and the U.K. NCSC’s tracking under CHOSEN BRICK indicate cross-jurisdictional visibility; coordination on notification to at-risk civil-society and press targets, and on takedowns of malicious Telegram infrastructure, will be central to response plans.
- Affected journalists and dissidents: Operators use social engineering on Telegram, WhatsApp and Instagram to pose as trusted contacts or technical support, delivering payloads that appear to be familiar applications. The observed capability set includes session-file exfiltration and saved-password theft, heightening the risk that private communications and contact lists could be compromised and published.
Group-IB characterizes the operation as a "flexible, multi-stage infection chain" that combines tailored social engineering, application masquerading, defense evasion and persistent access, and highlights the "extensive use of Telegram" as a low-cost, natively encrypted C2 channel. With HEAVYGRAM and CRUDEEXCLUDE both active in the observed chains and allied agencies issuing alerts, defenders and potential targets face a toolset designed explicitly to blend into familiar messaging workflows while enabling broad data theft and sustained access.
