HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)

Key facts for HEAVYGRAM Telegram backdoor

Detection coverage for HEAVYGRAM Telegram backdoor

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5327 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: HEAVYGRAM Script-Host PowerShell Cradle and CRUDEEXCLUDE Staging — Delivery/Execution

Detects the HEAVYGRAM delivery chain from TL-2026-5327: WSF/VBS/HTA script hosts (wscript, cscript, mshta) launching PowerShell download cradles, and any process or command line touching the CRUDEEXCLUDE staging artefacts (C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, downloaded_file26.txt, ExtractedFile26.dat, File26.zip). These are the first steps before the Telegram-C2 Python implant is launched.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.001, T1059.005, T1140, T1036.005
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1, DeviceProcessEvents, windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), img=lower(Image), cmd=lower(CommandLine)
```HEAVYGRAM delivery: WSF/VBS/HTA script hosts spawning PowerShell download cradles```
| eval script_cradle=if(match(parent,"(wscript|cscript|mshta)[.]exe$") AND match(img,"(powershell|pwsh)[.]exe$") AND match(cmd,"downloadstring|downloadfile|invoke-webrequest|invoke-expression|frombase64string|vultrobjects|api[.]telegram[.]org"),1,0)
```CRUDEEXCLUDE staging: SMQDServicePackages extraction path and base64 resource decode artefacts```
| eval crude_staging=if(match(cmd,"smqdservicepackages|488ht1-8ww648q|downloaded_file26|extractedfile26|file26[.]zip") OR match(img,"smqdservicepackages|488ht1-8ww648q"),1,0)
| where script_cradle=1 OR crude_staging=1
| eval detection_reason=case(script_cradle=1 AND crude_staging=1,"cradle_and_staging",script_cradle=1,"script_host_powershell_cradle",true(),"crudeexclude_staging")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, detection_reason
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend ParentName = tolower(InitiatingProcessFileName), Cmd = tolower(ProcessCommandLine)
| where (ParentName in ("wscript.exe", "cscript.exe", "mshta.exe")
    and FileName in~ ("powershell.exe", "pwsh.exe")
    and Cmd has_any ("downloadstring", "downloadfile", "invoke-webrequest", "invoke-expression", "frombase64string", "vultrobjects", "api.telegram.org"))
    or Cmd has_any ("smqdservicepackages", "488ht1-8ww648q", "downloaded_file26", "extractedfile26", "file26.zip")
    or FolderPath has_any ("SMQDServicePackages", "488ht1-8ww648q")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: HEAVYGRAM Script Host PowerShell Cradle or CRUDEEXCLUDE Staging Artifacts
id: 3f6b1c2e-8a4d-4e17-9c52-6d0a7b1e2f01
status: experimental
description: Detects WSF/VBS/HTA script hosts launching PowerShell download cradles and command lines referencing CRUDEEXCLUDE staging artifacts (SMQDServicePackages, downloaded_file26, ExtractedFile26) used to deliver the HEAVYGRAM Telegram-C2 backdoor (TL-2026-5327).
references:
    - https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1059.005
    - attack.defense-evasion
    - attack.t1140
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_cradle:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Invoke-Expression'
            - 'FromBase64String'
            - 'vultrobjects.com'
            - 'api.telegram.org'
    selection_staging:
        CommandLine|contains:
            - 'SMQDServicePackages'
            - '488ht1-8ww648q'
            - 'downloaded_file26'
            - 'ExtractedFile26'
    selection_staging_image:
        Image|contains: '\SMQDServicePackages\'
    condition: 1 of selection_*
falsepositives:
    - Administrative logon scripts that use a script host to call PowerShell download cradles
    - Software deployment tooling that stages installers via VBScript or HTA
level: high

Known false positives:

• Legacy logon scripts or IT automation where wscript/cscript/mshta legitimately launches PowerShell with web download cmdlets
• Software deployment tools staging installers through VBScript or HTA wrappers

Tuning notes: Exclude known-good management parents/hosts via a lookup on ParentImage+host. The CRUDEEXCLUDE path branch (SMQDServicePackages / 488ht1-8ww648q) is near-zero noise and can be alerted independently at critical priority. Widen the cradle keyword list with your environment's proxy hostnames if script hosts legitimately fetch content.

• 🔒 HEAVYGRAM Vultr Object Storage Payload Download and Persona Domain Contact — Exploitation · unlock with TL Creds
• 🔒 HEAVYGRAM bthudtask.exe DLL Side-Loading from Trailing-Space Directory — Post-Exploitation · unlock with TL Creds
• 🔒 HEAVYGRAM Telegram Desktop Session Data (tdata) Access by Non-Telegram Process — Collection · unlock with TL Creds
• 🔒 HEAVYGRAM and CRUDEEXCLUDE File Artifacts — Lockfile, Config and Staging Files — Exploitation · unlock with TL Creds
• 🔒 HEAVYGRAM Run Key Persistence Pointing to SMQDServicePackages or ProgramData — Persistence · unlock with TL Creds
• 🔒 HEAVYGRAM os.popen Discovery Commands Spawned by Python or SMQDServicePackages Parent — Discovery/C2 Tasking · unlock with TL Creds
• 🔒 CRUDEEXCLUDE Microsoft Defender Path Exclusions for HEAVYGRAM Staging Directories — Post-Exploitation · unlock with TL Creds
• 🔒 HEAVYGRAM Telegram Bot API C2 and ipify Lookup from Non-Telegram Process — C2 · unlock with TL Creds

Indicators of compromise for HEAVYGRAM Telegram backdoor

As of 2026-11-05, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5327.

Sample indicators (3 of 30)

• Domain: api[.]telegram[.]org
• URL: hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/efg_d4.zip
• File hash: 8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Community OSINT corroboration for HEAVYGRAM Telegram backdoor

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How HEAVYGRAM Telegram backdoor works

HEAVYGRAM is a Python-based Windows surveillance backdoor that uses the Telegram Bot API as its command-and-control channel. Group-IB's earliest identified sample dates to 13 September 2023, and the report states the infrastructure remains operational. Victims are approached over Telegram (and, per press coverage, WhatsApp and Instagram) by operators impersonating known contacts or technical support, and are handed masqueraded applications such as Telegram Authenticator, WhatsApp, KeePass and Pictory Premium (v9.0.4).

Four delivery methods are described: WSF/VBS scripts that run PowerShell cradles; VBScript and HTA files that poll the Telegram bot API; executables with an embedded ZIP archive; and CRUDEEXCLUDE executables with embedded archives. CRUDEEXCLUDE is a Delphi-based utility, first observed in late July 2024, that masquerades as legitimate software, decodes a base64 embedded resource (%APPDATA%\downloaded_file26.txt -> ExtractedFile26.dat -> File26.zip), extracts it to C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, launches the HEAVYGRAM implant and configures Microsoft Defender exclusions (%ALLUSERSPROFILE%\MicrosoftDistribution\sysmain, the user's Downloads\Telegram Desktop folder, and the SMQDServicePackages path). Payloads and decoys (Artificial intelligence.pptx, 0412.mp4, RuntimeSSH_*.zip, efg_d4.zip, Pictory_premium_ver9.0.4.exe, Telegram.exe) are hosted on Vultr Object Storage buckets.

The implant accepts operator commands through the bot: ## prefixed commands (runexe, whois, runtro, cht, regtro, reg, dt, si, pl, ss), @@ prefixed OS command execution via os.popen, and ** prefixed configuration staging to C:\ProgramData\ur.txt. It captures screenshots and audio, exfiltrates Telegram Desktop session data ('dt'), collects system information and process lists, queries api.ipify.org for the public IP, and exfiltrates collected data via the Telegram API. Persistence uses HKCU/HKLM Run keys and a lockfile (C:\ProgramData\lockfile49c4e.lock) prevents duplicate instances. DLL side-loading is performed by copying the legitimate C:\Windows\SysWOW64\bthudtask.exe into a look-alike directory with a trailing space ('C:\Windows \SysWOW64\') alongside an attacker DLL (name prefixes dev, bit, kee), then deleting the directory afterwards.

Group-IB attributes the activity with moderate confidence to Handala Hack, assessed as an online persona of Void Manticore operating on behalf of Iran's Ministry of Intelligence and Security (MOIS). Supporting evidence cited includes a U.S. DOJ affidavit linking HEAVYGRAM to Handala Hack, FBI FLASH corroboration of technical indicators, intrusions against Iran International journalists, and tradecraft overlap (Vultr Object Storage, Persian-language decoys, Delphi tooling). Related MOIS-linked personas include Homeland Justice and Karma/KarmaBelow80. Targets are Iranian dissidents, journalists, MEK-aligned organizations and individuals with anti-government views, including a UK-based Farsi-language news organization and a U.S.-based victim.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL

Discovery

T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.002 User Execution: Malicious File

Command and Control

T1102.002 Web Service: Bidirectional Communication

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566.002 Phishing: Spearphishing Link

Resource Development

T1583.006 Acquire Infrastructure: Web Services

defense-impairment

T1685 Disable or Modify Tools

Remediation for HEAVYGRAM Telegram backdoor

Immediate actions

• Isolate hosts showing HEAVYGRAM or CRUDEEXCLUDE indicators and rotate any Telegram, KeePass and other credentials used on them
• Audit HKCU/HKLM Software\Microsoft\Windows\CurrentVersion\Run for unexpected autoruns
• Search filesystems for the trailing-space directory 'C:\Windows \' and for bthudtask.exe outside its legitimate path
• Review Microsoft Defender exclusions for %ALLUSERSPROFILE%\MicrosoftDistribution\sysmain, SMQDServicePackages and Downloads\Telegram Desktop
• Review outbound HTTPS to api.telegram.org and Vultr Object Storage hosts for anomalous bot API calls

Workarounds

• Install applications only from official vendor sources
• Verify contact authenticity over an alternative trusted channel before opening files received on Telegram, WhatsApp or Instagram
• Set messaging and social media privacy settings to the minimum exposure

Longer-term hardening

• Restrict binary execution from %APPDATA%, C:\ProgramData and other user-writable directories via application control
• Block or monitor api.telegram.org where Telegram is unsanctioned
• Alert on directory creation with trailing spaces and on os.popen-style shell invocation from non-standard processes
• Alert on unauthorized process access to %APPDATA%\Telegram Desktop
• Enforce code signing validation

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints running Telegram Desktop; no specific versions stated

Timeline of HEAVYGRAM Telegram backdoor

• 2023-09-13 Earliest locked-ioc-30 sample identified by Group-IB, indicating activity since fall 2023
• 2023-12-02 Persian-language screensaver delivery variant submitted from Germany
• 2024-04-14 WSF script delivery variant submitted from Turkiye
• 2024-07-31 locked-ioc-29 Delphi-based staging utility first observed (late July 2024)
• 2026-03-19 U.S. DOJ seized MOIS-linked infrastructure and domains (locked-ioc-24, locked-ioc-26, locked-ioc-23, locked-ioc-27)
• 2026-03-20 FBI FLASH report disclosed technical indicators corroborating the locked-ioc-30 and Handala Hack link
• 2026-09-17 Group-IB published its locked-ioc-30 analysis, linking the backdoor with moderate confidence to Handala Hack / Void Manticore and reporting infrastructure still operational

Sources cited for HEAVYGRAM Telegram backdoor

• MITRE ATT&CK: Void Manticore (G1055) MITRE · Research
• Threat Intelligence Brief: Handala / Void Manticore (Securin) securin.io · Research
• HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack group-ib.com · Blog · 2026-09-17
• Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Surveillance Malware The Hacker News · News · 2026-09-17
• Hackers turn Telegram into a command center for HEAVYGRAM surveillance malware cryptika.com · News
• HEAVYGRAM kill chain (SecurityOnline) securityonline.info · News
• Handala Hack, HEAVYGRAM, CRUDEEXCLUDE Iran Telegram cyber espionage (abit.ee) abit.ee · News
• Telegram turned into a control panel for HEAVYGRAM spyware (Anti-Malware.ru) anti-malware.ru · News · 2026-09-22

More in malware

• Mirax Android RAT: Server-side Device Takeover Targeting META Banking Customers via Malicious Ads in Streaming Apps
• Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2
• Multi-Stage Windows PowerShell Loader Chain Delivering Themida/UPX-Protected Native Payload (contis.exe) with In-Memory Cryptographic Reconstruction
• China-Aligned SlippyNunchucks Hijacks Sogou Input Method DNS Requests to Deploy DarkVigil (FDMTP) Backdoor (CVE-2026-120422)
• XLoader (FormBook) Infostealer Delivered via Fake Business Order Phishing, RAR/JScript/LuaJIT Chain with In-Memory Injection