Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor

Iranian hacktivist group Handala Hack is linked to HEAVYGRAM, a trojan spread via Telegram. The backdoor can execute commands remotely, collect system and network data, steal passwords and Telegram sessions, take screenshots, and load DLLs.

• HEAVYGRAM operates via Telegram and supports remote command execution
• Trojan steals Telegram data files and sessions, takes screenshots
• Attacks also use the Delphi utility CRUDEEXCLUDE
• Handala Hack group is linked to Iran