Threat video1:00
HEAVYGRAM Telegram C2 Backdoor: Detection & IOCs
HEAVYGRAM runs its Windows C2 through Telegram's bot API; 9 detection rules, 30 IOCs and a free Splunk SPL rule are included.
Read the full threat intel for HEAVYGRAM Telegram C2 Backdoor: Detection & IOCs →
Chapters
- 0:00The hookHEAVYGRAM malware targets Iranian dissidents
- 0:04The storyMasquerades as legitimate apps
- 0:10Attack pathDelivered via Telegram, social engineering
- 0:24AttributionAttributed to VOID MANTICORE - G1055.
- 0:30Indicators of compromise25 indicators to hunt: 4 domains, 8 URLs and 10 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to command and control.
- 0:44Remediation5 steps now: Isolate hosts showing HEAVYGRAM or CRUDEEXCLUDE indicators and rotate any.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00HEAVYGRAM malware targets Iranian dissidents
0:05Masquerades as legitimate apps
0:07Steals Telegram and audio
0:10Delivered via Telegram, social engineering
0:13PowerShell runs, Defender disabled
0:16Telegram bot as C2
0:18Captures screens, audio, Telegram data
0:21Exfiltrates via bot
0:24Attributed to VOID MANTICORE - G1055. Confidence: medium.
0:3025 indicators to hunt: 4 domains, 8 URLs and 10 SHA-256 hashes, and more.
0:3917 ATT&CK techniques, from resource development to command and control.
0:445 steps now: Isolate hosts showing HEAVYGRAM or CRUDEEXCLUDE indicators and rotate any.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.