# HEAVYGRAM: Telegram-based Surveillance Backdoor Linked to Handala Hack (Void Manticore / MOIS)

> Group-IB reports HEAVYGRAM, a Telegram-C2 Windows surveillance backdoor linked with moderate confidence to Handala Hack, assessed as an online persona of Void Manticore (Storm-0842, Banished Kitten, Red Sandstorm) operating on behalf of Iran's MOIS. It is delivered through Telegram social engineering using masqueraded apps (KeePass, Pictory, Telegram, WhatsApp) against Iranian dissidents, journalists and opposition members; the Delphi-based CRUDEEXCLUDE staging utility was also identified.

- **Published:** 2026-11-05T15:09:12Z
- **Last reviewed:** 2026-11-05T15:09:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5327
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5327.png
- **ID:** TL-2026-5327
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** VOID MANTICORE - G1055 (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

HEAVYGRAM is a Python-based Windows surveillance backdoor that uses the Telegram Bot API as its command-and-control channel. Group-IB's earliest identified sample dates to 13 September 2023, and the report states the infrastructure remains operational. Victims are approached over Telegram (and, per press coverage, WhatsApp and Instagram) by operators impersonating known contacts or technical support, and are handed masqueraded applications such as Telegram Authenticator, WhatsApp, KeePass and Pictory Premium (v9.0.4).

Four delivery methods are described: WSF/VBS scripts that run PowerShell cradles; VBScript and HTA files that poll the Telegram bot API; executables with an embedded ZIP archive; and CRUDEEXCLUDE executables with embedded archives. CRUDEEXCLUDE is a Delphi-based utility, first observed in late July 2024, that masquerades as legitimate software, decodes a base64 embedded resource (%APPDATA%\downloaded_file26.txt -> ExtractedFile26.dat -> File26.zip), extracts it to C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, launches the HEAVYGRAM implant and configures Microsoft Defender exclusions (%ALLUSERSPROFILE%\MicrosoftDistribution\sysmain, the user's Downloads\Telegram Desktop folder, and the SMQDServicePackages path). Payloads and decoys (Artificial intelligence.pptx, 0412.mp4, RuntimeSSH_*.zip, efg_d4.zip, Pictory_premium_ver9.0.4.exe, Telegram.exe) are hosted on Vultr Object Storage buckets.

The implant accepts operator commands through the bot: ## prefixed commands (runexe, whois, runtro, cht, regtro, reg, dt, si, pl, ss), @@ prefixed OS command execution via os.popen, and ** prefixed configuration staging to C:\ProgramData\ur.txt. It captures screenshots and audio, exfiltrates Telegram Desktop session data ('dt'), collects system information and process lists, queries api.ipify.org for the public IP, and exfiltrates collected data via the Telegram API. Persistence uses HKCU/HKLM Run keys and a lockfile (C:\ProgramData\lockfile49c4e.lock) prevents duplicate instances. DLL side-loading is performed by copying the legitimate C:\Windows\SysWOW64\bthudtask.exe into a look-alike directory with a trailing space ('C:\Windows \SysWOW64\') alongside an attacker DLL (name prefixes dev, bit, kee), then deleting the directory afterwards.

Group-IB attributes the activity with moderate confidence to Handala Hack, assessed as an online persona of Void Manticore operating on behalf of Iran's Ministry of Intelligence and Security (MOIS). Supporting evidence cited includes a U.S. DOJ affidavit linking HEAVYGRAM to Handala Hack, FBI FLASH corroboration of technical indicators, intrusions against Iran International journalists, and tradecraft overlap (Vultr Object Storage, Persian-language decoys, Delphi tooling). Related MOIS-linked personas include Homeland Justice and Karma/KarmaBelow80. Targets are Iranian dissidents, journalists, MEK-aligned organizations and individuals with anti-government views, including a UK-based Farsi-language news organization and a U.S.-based victim.

## MITRE ATT&CK

- T1583.006 Acquire Infrastructure: Web Services
- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1102.002 Web Service: Bidirectional Communication

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**HEAVYGRAM Script-Host PowerShell Cradle and CRUDEEXCLUDE Staging — Delivery/Execution** (`TL-2026-5327-SPL-001`)

Detects the HEAVYGRAM delivery chain from TL-2026-5327: WSF/VBS/HTA script hosts (wscript, cscript, mshta) launching PowerShell download cradles, and any process or command line touching the CRUDEEXCLUDE staging artefacts (C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, downloaded_file26.txt, ExtractedFile26.dat, File26.zip). These are the first steps before the Telegram-C2 Python implant is launched.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.001, T1059.005, T1140, T1036.005
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode 1, DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), img=lower(Image), cmd=lower(CommandLine)
```HEAVYGRAM delivery: WSF/VBS/HTA script hosts spawning PowerShell download cradles```
| eval script_cradle=if(match(parent,"(wscript|cscript|mshta)[.]exe$") AND match(img,"(powershell|pwsh)[.]exe$") AND match(cmd,"downloadstring|downloadfile|invoke-webrequest|invoke-expression|frombase64string|vultrobjects|api[.]telegram[.]org"),1,0)
```CRUDEEXCLUDE staging: SMQDServicePackages extraction path and base64 resource decode artefacts```
| eval crude_staging=if(match(cmd,"smqdservicepackages|488ht1-8ww648q|downloaded_file26|extractedfile26|file26[.]zip") OR match(img,"smqdservicepackages|488ht1-8ww648q"),1,0)
| where script_cradle=1 OR crude_staging=1
| eval detection_reason=case(script_cradle=1 AND crude_staging=1,"cradle_and_staging",script_cradle=1,"script_host_powershell_cradle",true(),"crudeexclude_staging")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, detection_reason
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend ParentName = tolower(InitiatingProcessFileName), Cmd = tolower(ProcessCommandLine)
| where (ParentName in ("wscript.exe", "cscript.exe", "mshta.exe")
    and FileName in~ ("powershell.exe", "pwsh.exe")
    and Cmd has_any ("downloadstring", "downloadfile", "invoke-webrequest", "invoke-expression", "frombase64string", "vultrobjects", "api.telegram.org"))
    or Cmd has_any ("smqdservicepackages", "488ht1-8ww648q", "downloaded_file26", "extractedfile26", "file26.zip")
    or FolderPath has_any ("SMQDServicePackages", "488ht1-8ww648q")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
```

### Sigma

```yaml
title: HEAVYGRAM Script Host PowerShell Cradle or CRUDEEXCLUDE Staging Artifacts
id: 3f6b1c2e-8a4d-4e17-9c52-6d0a7b1e2f01
status: experimental
description: Detects WSF/VBS/HTA script hosts launching PowerShell download cradles and command lines referencing CRUDEEXCLUDE staging artifacts (SMQDServicePackages, downloaded_file26, ExtractedFile26) used to deliver the HEAVYGRAM Telegram-C2 backdoor (TL-2026-5327).
references:
    - https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1059.005
    - attack.defense-evasion
    - attack.t1140
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_cradle:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Invoke-Expression'
            - 'FromBase64String'
            - 'vultrobjects.com'
            - 'api.telegram.org'
    selection_staging:
        CommandLine|contains:
            - 'SMQDServicePackages'
            - '488ht1-8ww648q'
            - 'downloaded_file26'
            - 'ExtractedFile26'
    selection_staging_image:
        Image|contains: '\SMQDServicePackages\'
    condition: 1 of selection_*
falsepositives:
    - Administrative logon scripts that use a script host to call PowerShell download cradles
    - Software deployment tooling that stages installers via VBScript or HTA
level: high
```

**Known false positives:**

- Legacy logon scripts or IT automation where wscript/cscript/mshta legitimately launches PowerShell with web download cmdlets
- Software deployment tools staging installers through VBScript or HTA wrappers

**Tuning notes:** Exclude known-good management parents/hosts via a lookup on ParentImage+host. The CRUDEEXCLUDE path branch (SMQDServicePackages / 488ht1-8ww648q) is near-zero noise and can be alerted independently at critical priority. Widen the cradle keyword list with your environment's proxy hostnames if script hosts legitimately fetch content.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- HEAVYGRAM Vultr Object Storage Payload Download and Persona Domain Contact — Exploitation (locked: unlock with TL Creds)
- HEAVYGRAM bthudtask.exe DLL Side-Loading from Trailing-Space Directory — Post-Exploitation (locked: unlock with TL Creds)
- HEAVYGRAM Telegram Desktop Session Data (tdata) Access by Non-Telegram Process — Collection (locked: unlock with TL Creds)
- HEAVYGRAM and CRUDEEXCLUDE File Artifacts — Lockfile, Config and Staging Files — Exploitation (locked: unlock with TL Creds)
- HEAVYGRAM Run Key Persistence Pointing to SMQDServicePackages or ProgramData — Persistence (locked: unlock with TL Creds)
- HEAVYGRAM os.popen Discovery Commands Spawned by Python or SMQDServicePackages Parent — Discovery/C2 Tasking (locked: unlock with TL Creds)
- CRUDEEXCLUDE Microsoft Defender Path Exclusions for HEAVYGRAM Staging Directories — Post-Exploitation (locked: unlock with TL Creds)
- HEAVYGRAM Telegram Bot API C2 and ipify Lookup from Non-Telegram Process — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- Domain: `api[.]telegram[.]org`
- URL: `hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/efg_d4.zip`
- File hash: `8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack](https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2/)
- [Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Surveillance Malware](https://thehackernews.com/2026/09/iran-linked-handala-hack-tied-to.html)
- [Hackers turn Telegram into a command center for HEAVYGRAM surveillance malware](https://www.cryptika.com/hackers-turn-telegram-into-a-command-center-for-heavygram-surveillance-malware)
- [HEAVYGRAM kill chain (SecurityOnline)](https://securityonline.info/heavygram-malware/)
- [Handala Hack, HEAVYGRAM, CRUDEEXCLUDE Iran Telegram cyber espionage (abit.ee)](https://abit.ee/en/cybersecurity/hackers-and-attacks/handala-hack-heavygram-crudeexclude-iran-telegram-cyber-espionage-en)
- [Telegram turned into a control panel for HEAVYGRAM spyware (Anti-Malware.ru)](https://www.anti-malware.ru/news/2026-09-22-111332/51494)
- [MITRE ATT&CK: Void Manticore (G1055)](https://attack.mitre.org/groups/G1055)
- [Threat Intelligence Brief: Handala / Void Manticore (Securin)](https://www.securin.io/articles/threat-intelligence-brief-handala-void-manticore)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5327