HEAVYGRAM is designed to blend into Telegram traffic while providing its operators with a broad remote access toolkit. Its built-in commands support:

• Remote command execution
• System, network, and process information discovery
• Exfiltration of data and Telegram session files
• Screenshot capture
• DLL sideloading

The backdoor's reliance on Telegram as a command-and-control channel makes its activity harder to distinguish from legitimate messaging traffic, while its ability to lift Telegram session files raises the risk of account takeover and further credential theft.

The campaign also employs CRUDEEXCLUDE, a Delphi-based utility that appears to complement the backdoor's operations. The reporting ties both tools to the Handala Hack persona, which has been assessed as Iran-linked.

Defenders should watch for unexpected Telegram-related processes and outbound traffic, unauthorized DLL sideloading activity, and signs of session file access on monitored endpoints.

Source: The Hacker News

Has anyone observed Telegram-linked command-and-control or session file theft in their environment, and how are you detecting it?