[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSG2vRsti29G1M7xukIB2mfgjWw-9ZXIslGxS42PEQ6o":3},{"article":4,"iocs":54,"watch_terms":67,"solutions":68,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3836395b-5d04-44fb-9bc6-06a7ca0f902e","Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords","iran-linked-handala-hack-tied-to-heavygram-telegram-backdoor-that-can-steal-pass-a2011e","The Iran-linked \"hacktivist\" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. \"HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,","The Iran-linked Handala Hack persona has been linked to the HEAVYGRAM Telegram-based surveillance backdoor and the CRUDEEXCLUDE utility. This malware, first seen in July 2024, is designed for intelligence gathering, including stealing passwords, capturing screenshots, and exfiltrating data. It often masquerades as legitimate software and uses Microsoft Defender exclusion paths for evasion, with command and control managed via Telegram.","Iran-linked Handala Hack uses HEAVYGRAM backdoor for surveillance and password theft.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Firan-linked-handala-hack-tied-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhdqFZ07lueoUFevcbuCOBavlR6CaAxmFqFs7hLpyqw-maKbLcISxW0Q-y7JwvoRrhDumRNaJo_Z4T6QRrGLUTDEE8yYqFfoRLmkoc_J4omdeCAmew1_5k-NwnNWJyYawal5nni-TVZu8M4aDsGNhbwlpp1Y7wLUSjsFR-olY89Mls9hD4CiL9jq0roUpzA\u002Fs1600\u002Ftelegram-handala.jpg","2026-09-17T14:03:13+00:00","2026-09-18T04:00:07.533027+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Handala Hack","threat_actor",{"name":21,"type":19},"Void Manticore",{"name":23,"type":19},"Banished Kitten",{"name":25,"type":19},"Red Sandstorm",{"name":27,"type":19},"Storm-0842",{"name":29,"type":30},"HEAVYGRAM","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57,60,63],{"type":48,"value":29,"context":56},"Telegram-based surveillance backdoor",{"type":48,"value":58,"context":59},"CRUDEEXCLUDE","Delphi-based Windows utility for environment preparation",{"type":48,"value":61,"context":62},"CHOSEN BRICK","UK NCSC moniker for the same malware family",{"type":64,"value":65,"context":66},"domain","api.ipify.org","Used by HEAVYGRAM to retrieve the host's public IP",[29],{"controls":69,"vendors":153},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":100,"name":101,"problem":102,"products":103},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"slug":129,"name":130,"problem":131,"products":132},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[133,139,146],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":134,"product_name":135,"url":137,"description":138},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":140,"product_name":143,"url":144,"description":145},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":129,"product_name":150,"url":151,"description":152},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":171},"iran-linked-handala-backdoor-uses-telegram-c2-and-defender-evasion-to-steal-credentials","Iran-Linked Handala Backdoor Uses Telegram C2 and Defender Evasion to Steal Credentials","The HEAVYGRAM backdoor highlights how sophisticated threat actors combine social engineering with living-off-the-land techniques — in this case, abusing Microsoft Defender exclusion paths to evade endpoint detection while masquerading as legitimate software. By leveraging Telegram as a command-and-control channel, the malware blends into normal network traffic, making detection significantly harder. This campaign underscores the danger of users executing unverified software and the critical importance of hardening endpoint configurations against deliberate evasion. Organizations without robust monitoring of Defender policy changes and outbound messaging-app traffic are particularly exposed to this class of threat.",[159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 AC-6: Least Privilege","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1071.001: Application Layer Protocol – Web Protocols (Telegram C2)","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (data exfiltration risk)",{}]