hacker-news Sep 17, 2026 · Crawled Sep 18, 2026

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

1 IoCs 1 Actors

AI Summary

The Iran-linked threat actor known as Handala Hack, attributed to the MOIS-affiliated group Void Manticore, has been linked to a multi-stage malware campaign using the Telegram-based backdoor HEAVYGRAM and the Delphi-based utility CRUDEEXCLUDE. HEAVYGRAM is a Python-based backdoor that uses Telegram for command-and-control, enabling remote command execution, data exfiltration (including Telegram and WhatsApp data and saved passwords), screenshot capture, and persistence via Windows Registry keys. The malware is delivered through social engineering on messaging platforms, often disguised as legitimate applications like Pictory, KeePass, or Telegram, and leverages PowerShell and DLL sideloading for execution and evasion. CRUDEEXCLUDE prepares the environment by configuring Microsoft Defender exclusions and staging HEAVYGRAM and other payloads.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor Void Manticore →

Indicators of Compromise 1 extracted

Type	Value	Detail
Domain	api[.]ipify[.]org	Details →

MITRE ATT&CK TTPs 12 techniques

T1003 OS Credential Dumping · Credential Access T1021 Remote Services · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1056 Input Capture · Collection T1059.001 PowerShell · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1083 File and Directory Discovery · Discovery T1110 Brute Force · Credential Access T1204.002 Malicious File · Execution T1543.003 Windows Service · Persistence T1566 Phishing · Initial Access