Handala Hack: Inside Iranian HEAVYGRAM Telegram Backdoor

Executive Summary

Group-IB Threat Intelligence has uncovered extensive operational tooling linked to Handala Hack, a notorious persona attributed to Iran's Ministry of Intelligence and Security (MOIS). While publicly branding itself as a grassroots hacktivist collective supporting Palestinian causes since late 2023, Handala Hack operates in reality as a state-sponsored espionage and cyber warfare unit.

Recent investigations reveal the group deploying a multi-stage intrusion framework centered around HEAVYGRAM (also tracked as CHOSEN BRICK by the UK NCSC)—a sophisticated Windows backdoor that leverages the Telegram Bot API for stealthy command-and-control (C2) and exfiltration. Operating alongside HEAVYGRAM is CRUDEEXCLUDE, a specialized Delphi-compiled stager engineered to preemptively disable Microsoft Defender detections and facilitate covert payload deployment across Israeli critical infrastructure, defense organizations, and Iranian political dissidents abroad.

Technical Vulnerability Analysis & Attack Chain

The Handala Hack infection chain combines deceptive social engineering with living-off-the-land (LotL) execution and defense evasion techniques:

[Spear-Phishing Lure / AI Tool]

│

▼

[Stage 1: WSF / VBS / HTA Loader] ─── (Checks Disk Size > 50GB)

│

▼

[Stage 2: CRUDEEXCLUDE Delphi Utility]

│

├──► Disables Microsoft Defender (Add-MpPreference -ExclusionPath)

│

▼

[Stage 3: HEAVYGRAM Persistent Backdoor]

│

├──► Dual-Bot Telegram C2 Protocol (Commands: ##runexe, ##reg, ##dt, etc.)

└──► DLL Sideloading via Spoofed Path (C:\Windows \SysWOW64\bthudtask.exe)

1. Initial Access & Defense Evasion Stagers

Attackers distribute malicious payloads masquerading as AI video editing utilities (e.g., Pictory_premium_ver9.0.4.exe), artificial intelligence briefing presentations (Artificial intelligence.pptx), and legitimate productivity archives hosted on public Vultr Object Storage buckets (vultrobjects.com).

First-stage vectors utilize Windows Script Files (WSF), VBScript, or HTML Applications (HTA) containing sandbox evasion checks:

• Environment Fingerprinting: The initial VBScript queries WMI to verify whether the host's primary C: drive volume exceeds 50 GB, terminating execution on virtualized malware analysis sandboxes.
• CRUDEEXCLUDE Execution: Upon validation, the loader executes CRUDEEXCLUDE, a Delphi-based executable that runs encoded PowerShell commands to add critical persistence directories to Microsoft Defender exclusion paths:

Add-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\MicrosoftDistribution\sysmain"

Add-MpPreference -ExclusionPath "C:\Users\<username>\Downloads\Telegram Desktop"

Add-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\SMQDServicePackages\488ht1-8ww648q"

2. HEAVYGRAM Telegram-Based C2 Architecture

Once defenses are neutralized, the persistent HEAVYGRAM backdoor initializes. HEAVYGRAM communicates exclusively through encrypted Telegram Bot API channels, organized into single-bot or dual-bot operational clusters. In dual-bot deployments, one bot processes operator tasking while a secondary bot logs host heartbeats and polls staging channels.

HEAVYGRAM parses incoming Telegram updates using structured command prefixes:

• ` Prefix**: Writes message bodies directly to C:\ProgramData\ur.txt`, serving as a staging buffer for configuration files and secondary payloads.
• `##` Command Suite:
  • ##runexe: Launches arbitrary system processes on the victim machine.
  • ##whois: Queries https://api[.]ipify[.]org to extract the victim's public egress IP.
  • ##runtro: Unpacks and executes secondary trojan implants.
  • ##cht: Dynamically updates the embedded Telegram bot token and operator chat ID.
  • ##reg / ##regtro: Establishes Windows autorun persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
  • ##dt: Targets and exfiltrates Telegram Desktop session data and encryption keys from %APPDATA%\Telegram Desktop and %LOCALAPPDATA%\Packages\TelegramMessengerLLP.
  • ##si & ##pl: Gathers detailed systeminfo host telemetry and running process privileges.
  • ##ss: Silently captures desktop screenshots and uploads JPEG frames to the operator channel.

3. DLL Sideloading via Trailing-Space Path Confusion

To execute secondary surveillance DLLs without triggering EDR file path alerts, HEAVYGRAM exploits directory parsing confusion:

• It creates a mock directory with a trailing whitespace: C:\Windows \SysWOW64\.
• It copies the legitimate Windows Bluetooth utility bthudtask.exe into the spoofed directory alongside a malicious DLL (such as dev*.dll, bit*.dll, or kee*.dll).
• When bthudtask.exe executes, Windows DLL search order rules load the malicious companion DLL. Immediately following execution, HEAVYGRAM cleans up and wipes the spoofed directory.

Threat Actor Profile & Campaign Attribution

Handala Hack emerged in October 2023, presenting itself on Telegram, X (Twitter), and dark web leak forums as an anti-Israel hacktivist collective. However, threat telemetry compiled by Group-IB, Google Threat Intelligence, the FBI, and the UK NCSC firmly links Handala to Iranian intelligence apparatuses:

• State Apparatus: Handala Hack functions under the direction of Iran's Ministry of Intelligence and Security (MOIS). The U.S. Department of Justice seized multiple Handala domain clusters and C2 staging servers in March 2026.
• Dual Operational Persona: While publicly claiming destructive wiper attacks and data leaks on social media, Handala simultaneously deploys HEAVYGRAM for covert, long-term intelligence gathering.
• Targeting Scope: Operations concentrate heavily on Israeli critical infrastructure (water utilities, electrical grids, defense manufacturers, municipal portals), Middle Eastern telecommunications, and high-profile Iranian dissidents, journalists, and human rights defenders residing in Europe and North America.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Enable Microsoft Defender Tamper Protection: Activate Tamper Protection across all managed endpoints to prevent unauthorized modifications to Defender exclusion lists via PowerShell or registry manipulation.
• Restrict PowerShell Script Execution: Deploy Application Control (WDAC) and Constrained Language Mode (CLM) to prevent execution of unapproved scripts and direct calls to Add-MpPreference.
• Enforce Endpoint Path Integrity: Audit and prevent standard user write access to root drives and spoofed directories containing trailing spaces (e.g., C:\Windows \).

2. Network & Perimeter Defenses

• Block Unauthorized Telegram API Traffic: At the perimeter firewall and secure web gateway (SWG), block direct HTTP/HTTPS egress to api.telegram.org from general corporate workstations, permitting connections only for authorized administrative proxies.
• Filter Cloud Staging Buckets: Block outbound access to suspicious object storage endpoints, particularly Vultr S3 storage buckets containing unvetted executable downloads (*.vultrobjects.com).
• Snort / Suricata Rule for Suspicious Telegram API Interaction:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"SECURITY HEAVYGRAM Telegram Bot C2 Outbound Beacon"; flow:to_server,established; content:"api.telegram.org"; http_host; content:"/bot"; http_uri; classtype:trojan-activity; sid:20261015; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Defender Exclusion Path Tampering

title: Microsoft Defender Exclusion Path Tampering via PowerShell

status: experimental

description: Detects suspicious PowerShell Add-MpPreference execution adding common HEAVYGRAM staging paths.

logsource:

category: process_creation

product: windows

detection:

selection:

Image|endswith:

- '\powershell.exe'

- '\pwsh.exe'

CommandLine|contains:

- 'Add-MpPreference'

- 'ExclusionPath'

CommandLine|contains:

- 'MicrosoftDistribution\sysmain'

- 'SMQDServicePackages'

- 'Telegram Desktop'

condition: selection

level: critical

tags:

- attack.defense_evasion

- attack.t1562.001

Splunk Hunting Query: Spoofed Windows Directory Execution

index=endpoint (EventCode=1 OR EventCode=4688)

| eval ProcessPath=lower(NewProcessName)

| where match(ProcessPath, "c:\\windows\s+\\syswow64\\bthudtask\.exe")

| table _time, Computer, Account, CommandLine, ParentProcessName