Profile assembled from related reporting. Attribution: reported.

Iran | Cyber News

highThreat Intelligence

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

Security researchers from Kaspersky and ESET have linked the Iran-aligned 'hacktivist' persona Handala Hack to a Telegram-based surveillance backdoor named HEAVYGRAM and a Delphi-based utility called CRUDEEXCLUDE. The malware supports remote command execution, system and network discovery, data and Telegram session file exfiltration, screenshot capture, DLL sideloading, and password theft. Active exploitation is reported via Telegram lures, with no official patch available; mitigation focuses on user awareness and endpoint monitoring.

The Hacker News10 days ago2 min read

highMalware

Iranian State-Linked Hackers Deploy CHOSEN BRICK Windows Malware in Global Surveillance Campaign

Government agencies have issued warnings about a Windows malware strain named CHOSEN BRICK, attributed to Iranian state-linked hackers, used to spy on dissidents, activists, and journalists globally. The campaign underscores ongoing threats to civil society and the need for robust endpoint defenses.

BleepingComputer13 days ago2 min read

highCyber Attacks

Multistate Water System Attacks Widen, Iran Suspected

Reports indicate that cyber attacks targeting ill-secured, Internet-exposed Programmable Logic Controllers (PLCs) at water systems are expanding across a dozen US states. Iranian threat actors are suspected, though attribution remains provisional. The intrusions exploit default credentials, known vulnerabilities, or misconfigurations in OT/ICS environments, raising concerns about potential disruption to water supply and treatment operations.

Dark readingabout 1 month ago1 min read

highCyber Attacks

US Unseals Indictment Against 17 Iranians Linked to Mabna Institute for $3.4 Billion IP Theft

The U.S. Department of Justice has unsealed an indictment charging 17 Iranian nationals with orchestrating a prolonged hacking-for-hire operation on behalf of the Iranian government. The group, identified as the Mabna Institute, is alleged to have conducted spear-phishing and brute-force attacks against hundreds of American institutions, resulting in the theft of sensitive intellectual property and data. The DOJ estimates the total economic loss at $3.4 billion. Authorities have coordinated the indictment with international law enforcement efforts to disrupt the group's infrastructure.

BleepingComputerabout 1 month ago2 min read

Iran

Quick answers

Related Articles

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

Iranian State-Linked Hackers Deploy CHOSEN BRICK Windows Malware in Global Surveillance Campaign

Multistate Water System Attacks Widen, Iran Suspected

US Unseals Indictment Against 17 Iranians Linked to Mabna Institute for $3.4 Billion IP Theft