Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

On September 17, 2026, security researchers from Kaspersky and ESET publicly attributed the Iran-linked hacktivist persona Handala Hack to a Telegram-based surveillance backdoor named HEAVYGRAM and a Delphi-based utility called CRUDEEXCLUDE. The findings, reported by The Hacker News, detail a malware campaign that leverages Telegram as both a command-and-control channel and a delivery vector.

HEAVYGRAM is a backdoor that communicates via Telegram, offering built-in commands for remote command execution, system/network/process information discovery, data and Telegram session file exfiltration, screenshot capture, and DLL sideloading. It also includes capabilities for stealing passwords and credentials. CRUDEEXCLUDE, a Delphi-based utility, is delivered alongside HEAVYGRAM and likely assists in the infection chain.

The campaign is believed to target individuals and entities via Telegram, with a global scope but a focus on the Middle East and regions of geopolitical interest to Iran. The exact infection count and specific victim organizations have not been publicly confirmed, but active exploitation is reported.

Attribution to Iran-linked actors is based on analysis by Kaspersky and ESET, with malware characteristics and tactics, techniques, and procedures (TTPs) aligning with known Iran-aligned threat activity. The campaign details are reported but should be verified with additional sources.

No official patch is available for HEAVYGRAM or CRUDEEXCLUDE. Mitigation involves avoiding suspicious Telegram links and files, keeping Telegram updated to the latest version, deploying endpoint security solutions, and monitoring for indicators of compromise associated with these malware families.