Telegram backdoor HEAVYGRAM steals passwords, Group-IB says

A Telegram backdoor called HEAVYGRAM, which can steal saved passwords and lift data out of messaging apps, has been attributed to the Iran-linked persona Handala Hack by the security research company Group-IB. In the same analysis, the researchers linked the activity to a second Windows tool named CRUDEEXCLUDE, a utility written in Delphi (a long-established programming language for building Windows programs) that prepares an infected computer for whatever malicious software arrives next.

Group-IB describes HEAVYGRAM as a Python-based backdoor, which means a program that gives an intruder a hidden way back into a machine after the first infection. According to the company, it offers built-in commands for remote command execution (making the computer run instructions sent from somewhere else), for gathering information about the system, its network and its running processes, for copying out data and Telegram session files, for taking screenshots, for DLL sideloading (tricking a legitimate program into loading a malicious supporting file), for cleaning up files it has left behind, and for staying on the machine through Windows autorun registry keys, the Windows settings that make a chosen program start again every time the computer is switched on.

The malware was first detected in the wild in September 2023. Once it runs, Group-IB reports, it blocks Microsoft Defender from scanning the folders where the malicious files are staged and executes PowerShell (the scripting tool built into Windows) to set up that persistence in the Windows Registry. Its working capabilities, once it is connected to its operator, include listing the programs that are running, taking screenshots, capturing data from web browsers, uploading and downloading files, switching on the computer's microphone, copying Telegram and WhatsApp data, stealing saved passwords, downloading further malware and deleting files.

Delivery depends on social engineering: talking to a target on messaging platforms such as Telegram, WhatsApp and Instagram, posing either as someone offering technical support or as a trusted contact, and then handing over malware dressed up as a harmless installer. Those installers have been made to look like legitimate applications including Pictory, KeePass and Telegram itself, and they carry a second-stage implant inside. Group-IB lists four delivery routes: WSF and VBS script files, VBScripts and HTML Application (HTA) files, which open and run like a small program, executables with archives embedded inside them, and CRUDEEXCLUDE packages carrying embedded archives.

Communication with the infected machine runs through Telegram. Messages arriving from the operator's bot are read according to a prefix system: a message beginning with @@ runs arbitrary system commands through os.popen; a message beginning with ** writes its body to the file C:\ProgramData\ur.txt; and a message beginning with ## unlocks a suite of backdoor commands. That suite includes runexe, which starts any program on the machine; whois, which looks up the computer's public IP address through api.ipify[.]org; runtro, which runs a secondary trojan; cht, which swaps in a new Telegram bot token and operator user ID; regtro and reg, which install the trojan payload and the main malware into Windows autorun keys; and dt, which copies out Telegram Desktop data. Files attached to bot messages are handled by matching their filenames against patterns.

Group-IB also describes two keep-alive functions. One, send_initial_message, sends a first contact message containing the compromised computer's full domain name; the other, send_health_msg, runs in the background and sends a heartbeat every 24 hours with that domain name to confirm the implant is still active. Reviewing the Telegram infrastructure behind the campaigns, the researchers found two common setups: one built on a single Telegram bot plus a group, and another where one bot handles check-ins while a second bot deals with logging and polling for the next stage, again with a group. In Group-IB's assessment, the operators combine tailored social engineering, applications masquerading as something else, defense evasion and persistent access, and Telegram gives them a command and control channel that is encrypted by design with low cost to set up, maintain and rotate.

CRUDEEXCLUDE has its own role in that chain. The Delphi-based utility was first observed in late July 2024 and is usually disguised as a legitimate application with a graphical user interface, the windows and buttons a person clicks on. Its job is to configure Microsoft Defender exclusion paths, in other words to tell the antivirus which folders to skip, so the next stage can be dropped in without being scanned. Google documented the tool in December 2025 as being used to create staging directories for HEAVYGRAM and for another malware family named SHADEGENES, while posing as applications such as Pictory and Telegram.

The attribution sits alongside government warnings. The FBI first issued an alert about this activity in March 2026 and repeated it more recently, accusing Iranian cyber actors working for the Ministry of Intelligence and Security (MOIS) of targeting Iranian dissidents, journalists opposed to Iran and other opposition groups in order to collect intelligence, leak data and damage reputations. The UK National Cyber Security Centre tracks the same malware family under the name CHOSEN BRICK, describing it as a flexible tool that can support a range of potential operational outcomes. Handala Hack appeared shortly after the armed attacks of October 7, 2023 by Hamas and other Palestinian militant groups on southern Israel, and is assessed to be an online persona run by Void Manticore (also known as Banished Kitten, Red Sandstorm and Storm-0842), an actor affiliated with MOIS that has a history of destructive wiping attacks and hack and leak operations. Last September the Canadian Rapid Response Mechanism called out the actor for targeting and doxxing five Iran International journalists as part of a hack and leak operation.

Nothing about these mechanics is exclusive to one group. A backdoor that hides inside a familiar-looking installer, tells the antivirus to ignore a folder and then keeps its instructions inside an everyday messaging app is the same shape as many criminal campaigns that have nothing to do with any government. That is why the practical lessons travel: software should come from the maker's own website or an official store and never from a file a stranger sends in a chat; unfamiliar entries in a computer's antivirus exclusion list deserve a second look; and passwords saved in a browser are among the first things an intruder like this goes after. For teams that want a closer look at how their own Windows machines, accounts and access rules are configured, AEU-I provides security-first IT, infrastructure and consulting.