Handala Hack Turns Telegram Into a Control Channel for Windows Espionage

New research reported on September 18, 2026 links the Iran-aligned Handala Hack persona to HEAVYGRAM, a Python backdoor that gives operators extensive control over compromised Windows systems.

The malware communicates through Telegram bots and can steal credentials, collect messaging data, record audio, capture screenshots, transfer files, and execute arbitrary commands. It also establishes Registry-based persistence and can install additional payloads.

Group-IB attributes the operation to Handala Hack, assessed to function under Void Manticore. The threat actor is also tracked as Banished Kitten, Red Sandstorm, and Storm-0842, and is affiliated with Iran’s Ministry of Intelligence and Security, or MOIS.

A second tool, CRUDEEXCLUDE, prepares systems for HEAVYGRAM and other payloads by configuring Microsoft Defender exclusions. Together, the tools create an infection chain suited to intelligence collection, data theft, exposure of stolen information, and potentially destructive follow-on activity.

Trusted-software disguises lead victims into a multi-stage infection

The campaign relies primarily on targeted social engineering rather than exploitation of a software vulnerability. Operators contact prospective victims over Telegram, WhatsApp, or Instagram while pretending to be trusted acquaintances or technical-support personnel.

They then provide an installer that appears to belong to a legitimate application. Observed decoys have impersonated Pictory, KeePass, and Telegram, covering productivity, password management, media, and messaging use cases.

HEAVYGRAM has reached victims through four documented delivery mechanisms:

1. WSF or VBS scripts.
2. VBScript combined with HTML Application files.
3. Executables carrying embedded archives.
4. CRUDEEXCLUDE samples containing embedded archives.

CRUDEEXCLUDE is a Delphi-based Windows utility that typically presents a graphical interface resembling genuine software. Its primary documented role is to create Microsoft Defender exclusion paths for directories where subsequent malicious components will be staged.

This step weakens endpoint scanning before the main backdoor executes. CRUDEEXCLUDE has also been associated with preparations for SHADEGENES, another malware family.

The utility was first observed in late July 2024 and first documented by Google in December 2025. HEAVYGRAM itself was first detected in the wild in September 2023.

No CVE is involved, and there is no vendor patch that closes the infection route. The affected Windows versions have not been disclosed.

HEAVYGRAM provides surveillance, credential theft, and remote execution

Once active, HEAVYGRAM gives its operator a broad set of espionage and system-control functions. It can enumerate system and network information, inspect running programs and processes, take screenshots, and obtain the host’s public IP address through api.ipify[.]org.

Its collection capabilities include browser information, saved passwords, Telegram Desktop application data, Telegram session files, and WhatsApp data. Theft of session material could allow an attacker to retain access to communications even after the original host is investigated.

The backdoor can also activate the microphone, upload or download files, delete data, start arbitrary processes, and deploy further malware. DLL sideloading is supported as another execution mechanism.

HEAVYGRAM interferes with Microsoft Defender by preventing scans of directories used to stage malicious payloads. It also launches PowerShell commands that configure Windows Registry persistence for a later implant.

Persistence is established through Windows autorun Registry keys. This allows either HEAVYGRAM itself or a secondary Trojan to restart when the user logs in or the system boots, depending on the configured location.

These capabilities make the malware useful beyond passive collection. An operator can move from surveillance and credential theft to additional deployment, disruption, or file destruction without changing the initial access method.

Telegram messages become backdoor instructions

HEAVYGRAM uses Telegram bots as its command-and-control infrastructure. Bot messages are parsed according to prefixes and command keywords, turning normal-looking messaging traffic into remote instructions.

The @@ prefix executes an arbitrary system command through Python’s os.popen. A message beginning with ** writes its content to C:\ProgramData\ur.txt, while ## activates the principal command set.

Named commands provide more specialized functions:

• runexe launches an arbitrary process.
• whois retrieves the host’s public IP address using api.ipify[.]org.
• runtro executes a secondary Trojan.
• cht changes the Telegram bot token and operator user ID used for C2.
• regtro adds the Trojan payload to Windows autorun Registry keys.
• reg creates autorun persistence for the primary executable.
• dt extracts Telegram Desktop data.

Files arriving through the bot are handled according to filename patterns. This design lets the operator send payloads and direct how they should be processed without maintaining conventional attack infrastructure.

Group-IB identified two main configurations. A simpler deployment uses one Telegram bot and one group, while a distributed variant separates victim check-ins from logging, polling, and later stages by using two bots and a group.

The persistent component also contains two communications functions. One transmits an initial beacon containing the compromised computer’s full domain name. The other operates in the background and sends a heartbeat with that domain name every 24 hours, enabling operators to identify implants that remain active.

Telegram offers practical advantages to the attacker: its infrastructure is inexpensive, bot credentials can be replaced, and malicious exchanges may blend into traffic associated with a widely deployed messaging service.

Handala Hack sits within a broader MOIS-linked operation

Handala Hack emerged shortly after the October 7, 2023 attacks by Hamas and other Palestinian militant groups against southern Israel. The persona has since been associated with destructive wiping and hack-and-leak activity.

The assessed operator behind it, Void Manticore, has pursued intelligence collection alongside reputational and destructive objectives. The multiple tracking names—Banished Kitten, Red Sandstorm, and Storm-0842—reflect how different security organizations classify the same or closely related activity.

An FBI alert issued in March 2026 and reiterated earlier this week accused cyber operators working for MOIS of targeting Iranian dissidents, journalists critical of Iran, and opposition groups. Reported objectives included intelligence gathering, publication of stolen information, and reputational attacks against selected individuals.

Last September, Canada’s Rapid Response Mechanism connected the actor to the targeting and doxxing of five Iran International journalists, including a journalist from Iran, during a hack-and-leak operation.

The U.K. National Cyber Security Centre tracks HEAVYGRAM as CHOSEN BRICK. Its range of collection and execution functions allows it to support different missions rather than a single, narrowly defined objective.

The research connecting Handala Hack to the malware consequently matters most for people already exposed to targeted surveillance: dissidents, journalists, opposition figures, and others selected for intelligence or influence operations.

Defenders should hunt for exclusions, autoruns, and messaging artifacts

There is no dedicated removal utility, formal vendor remediation procedure, or security update for HEAVYGRAM. Response therefore depends on identifying compromised hosts, removing persistence, and determining what information the operators accessed.

Defenders should inspect Microsoft Defender configuration for unauthorized exclusion paths, especially exclusions created shortly before scripts, archives, or unknown executables appeared. Newly created autorun Registry entries should be checked for unfamiliar executables and secondary Trojan payloads.

PowerShell activity deserves particular attention when it modifies Registry persistence, prepares staging directories, or follows the execution of an installer received through a messaging service.

Other useful detection points include:

• Unexpected WSF, VBS, and HTA execution.
• Executables containing embedded archives.
• Installers masquerading as Pictory, KeePass, or Telegram.
• Creation or modification of C:\ProgramData\ur.txt.
• Connections involving unapproved Telegram bots or groups.
• Access to Telegram Desktop session files or WhatsApp data.
• Requests to api.ipify[.]org made by suspicious processes.
• Unexplained screenshot capture or microphone activation.
• Browser-password access, unusual file transfers, or unexpected process creation.

A suspected machine should be isolated before defenders remove malicious autorun entries and unauthorized Defender exclusions. Responders should also search for additional payloads, determine whether files were deleted or exfiltrated, and review Telegram-related communications from the host.

Credentials stored in browsers should be rotated. Telegram and other messaging-session tokens exposed on the system should also be invalidated, because deleting the malware alone may not terminate an attacker’s access to stolen accounts.

HEAVYGRAM is not a vulnerability that can be solved by applying one patch. Its success depends on impersonation, user trust, endpoint-defense tampering, and durable remote access—requiring both technical hunting and careful verification of software delivered through private messages.