Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords
-
The Iran-linked hacktivist persona tracked as Handala Hack has been linked to a Telegram-based surveillance backdoor named HEAVYGRAM, along with a Delphi-based utility called CRUDEEXCLUDE, according to new research.
HEAVYGRAM is designed to blend into Telegram traffic while providing its operators with a broad remote access toolkit. Its built-in commands support:
- Remote command execution
- System, network, and process information discovery
- Exfiltration of data and Telegram session files
- Screenshot capture
- DLL sideloading
The backdoor's reliance on Telegram as a command-and-control channel makes its activity harder to distinguish from legitimate messaging traffic, while its ability to lift Telegram session files raises the risk of account takeover and further credential theft.
The campaign also employs CRUDEEXCLUDE, a Delphi-based utility that appears to complement the backdoor's operations. The reporting ties both tools to the Handala Hack persona, which has been assessed as Iran-linked.
Defenders should watch for unexpected Telegram-related processes and outbound traffic, unauthorized DLL sideloading activity, and signs of session file access on monitored endpoints.
Source: The Hacker News
Has anyone observed Telegram-linked command-and-control or session file theft in their environment, and how are you detecting it?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login