FHN 
The Handala Hack campaign uses a combination of social engineering, Microsoft Defender exclusions, multi-stage malware, and Telegram-based command-and-control to target Iranian dissidents, journalists, and others viewed as opponents of the Iranian government.
The campaign has also been connected to earlier U.S. government investigations. On March 19, the U.S. Department of Justice seized four domains that it said were linked to Iran’s Ministry of Intelligence and Security (MOIS) and were used for cyber-enabled psychological operations and transnational repression.
The seized domains included Handala-Hack[.]to and Handala-Redwanted[.]to.
Fake Software Used to Deliver Malware
A DOJ affidavit previously described HEAVYGRAM in attacks where victims were contacted through Telegram and persuaded to run malware disguised as legitimate software.
On September 15, the FBI released an expanded HEAVYGRAM FLASH report describing a Windows surveillance toolkit that uses Telegram bots, groups, and accounts to communicate with infected systems.
UK and Dutch authorities track the activity as CHOSEN BRICK, while the FBI has attributed HEAVYGRAM operations to actors working for MOIS.
The attackers use fake applications with convincing interfaces. While the victim sees what appears to be a normal program, the malware secretly extracts embedded files and launches the HEAVYGRAM implant.
Fake installers have previously been made to look like popular applications, including:
- KeePass
- Telegram
- Pictory
- Other messaging and media applications
One Persian-language screensaver lure also referenced a supplementary and expelled list, suggesting that some campaigns were customized for academics or students.
CRUDEEXCLUDE Weakens Defender
A key part of the attack is defense evasion.
CRUDEEXCLUDE uses PowerShell to add attacker-controlled folders to Microsoft Defender’s exclusion list. Files placed inside those locations can then avoid normal Defender scanning.
Researchers observed exclusions involving paths such as:
%ALLUSERSPROFILE%\MicrosoftDistribution\sysmain
C:\Users\<username>\Downloads\Telegram Desktop
%ALLUSERSPROFILE%\SMQDServicePackages\488ht1-8ww648q
After creating the exclusion, the malware decodes an embedded payload and saves it as a ZIP archive. The archive is extracted into C:\ProgramData, after which the HEAVYGRAM executable is launched using CreateProcessW.
This gives attackers a way to install their surveillance tool after reducing the endpoint’s security protections.
HEAVYGRAM Uses Telegram for Control
HEAVYGRAM is a Python-based Windows implant packaged with PyInstaller. It is designed to maintain access to compromised systems and communicate with its operators.
Group-IB identified CRUDEEXCLUDE samples disguised as trusted applications, including Pictory and Telegram.
Once running, HEAVYGRAM creates a mutex to prevent multiple copies from running at the same time. It stores configuration information in:
%APPDATA%\Config\config.xml
The malware also collects the computer name and uses hardcoded Telegram bot credentials and group or user IDs to communicate with its operators.
Instead of using traditional command-and-control infrastructure, the malware uses Telegram to exchange information and instructions.
What HEAVYGRAM Can Do
HEAVYGRAM can receive commands and files through the Telegram Bot API. This allows malicious traffic to blend with normal traffic to a widely used messaging platform.
The malware can reportedly:
- Execute shell commands
- List running processes
- Discover the victim’s public IP address
- Collect system information
- Capture screenshots
- Download and execute additional files
- Create Registry-based persistence
- Steal Telegram Desktop data
- Extract ZIP-based payloads
- Deploy additional malware
Some variants have also been reported to collect browser-stored information and credentials, record audio, delete files, and download additional malicious software.
Another technique involves DLL side-loading. In one example, attackers copy the legitimate bthudtask.exe executable into a fake C:\Windows\SysWOW64 directory containing an intentional trailing space.
What Security Teams Should Look For
Security teams should pay particular attention to activity that shows Defender protections being changed unexpectedly.
Important indicators include:
- PowerShell commands modifying Microsoft Defender exclusions
- Unusual exclusions involving
ProgramDataor download folders - Registry persistence using
SMQDServiceorwinappx - Fake KeePass, Telegram, or Pictory installers
- Unexpected connections to
api.telegram.org - Suspicious executions from unusual Windows directories
- Unapproved Telegram automation from corporate endpoints
Organizations that support journalists, researchers, activists, and diaspora communities should consider additional protections such as application allowlisting, Defender tamper protection, phishing-resistant MFA, strong endpoint monitoring, and strict verification of software received through messaging platforms.
The campaign shows how attackers can combine a convincing software lure with endpoint defense evasion and a legitimate messaging platform to maintain access to targeted systems.
For defenders, stopping the attack before the fake application is executed remains one of the most effective ways to prevent the malware from gaining a foothold.
IOCs
| Type | SHA256 | SHA1 | MD5 |
| First stage | 8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd | 0190940243f6535f51d43edafac943d493159e14 | b3c1a3eebefafe1346c6a864b5423182 |
| RAR artefact | 47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4 | 88a8d118ee190ac36cf684c2992f6ddd2dda517b | b2f6f40570ac9085b5463fdb623560de |
| Implant/Backdoor | d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e | 9108466c98df01033371483a789a0c23372c52f2 | 16602375fc2dae1eb54580ab7eda6567 |
| Encrypted text artefact | 3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81 | 53d41445e176bf53c5acd2dad533eda612b05855 | 7d3cce1f9dbaed585b61e6e903d69b9b |
About the Author
