Skip to main content

HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

0
Medium
Published: 09/17/2026 (09/17/2026, 21:02:31 UTC)
Source: AlienVault OTX General

Description

HEAVYGRAM is a multi-stage Windows backdoor linked to the Iran-associated threat actor Handala Hack, active since Fall 2023. It targets Iranian dissidents, journalists, and government opponents using social engineering to deliver malicious files disguised as legitimate applications. The malware uses the Telegram bot API for command-and-control, enabling remote execution, screen capture, data exfiltration, and persistence through DLL side-loading and registry modifications. Its infrastructure includes networks of Telegram bots and groups, and it aligns with known Iranian intelligence operations disclosed by the U.S. Department of Justice.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/18/2026, 08:31:44 UTC

Technical Analysis

HEAVYGRAM is a surveillance backdoor attributed to the Iran-linked threat actor Handala Hack, deployed since Fall 2023 against specific Iranian targets such as dissidents and journalists. It leverages the Telegram bot API for command-and-control, facilitating remote command execution, screen capture, data exfiltration, and persistent access via DLL side-loading and registry persistence. The malware is delivered through social engineering, masquerading as legitimate applications like Telegram, KeePass, or Pictory. Infrastructure analysis revealed 29 samples using Telegram bots and groups for operational control. The campaign's tradecraft includes the use of Vultr Object Storage and Persian-language decoys, consistent with Iranian Ministry of Intelligence and Security activities.

Potential Impact

The backdoor enables attackers to remotely execute commands, capture screens, exfiltrate sensitive data, and maintain persistent access on compromised Windows systems. This facilitates ongoing surveillance and espionage against targeted individuals, including dissidents and journalists, potentially compromising their privacy and safety. The use of Telegram for command-and-control complicates detection and takedown efforts.

Defensive Guidance

No specific patch or remediation is indicated for this malware. Defenders should focus on user awareness to prevent social engineering attacks, monitor for suspicious DLL side-loading and registry persistence behaviors, and analyze network traffic for unusual Telegram bot API communications. Incident response should include isolating infected systems and conducting forensic analysis to identify and remove the backdoor.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Author
AlienVault
Tlp
white
References
["https://www.group-ib.com/blog/heavygram-handala-hack-telegram-c2/"]
Adversary
Handala Hack
Pulse Id
6aac5567553cdb05e2f9e10c

Indicators of Compromise

Hash

ValueDescriptionCopy
hash0a656287defcbd8a9c47385b805993df
hash14698d3a03216daa2cf6f39e4f1c4031
hash16602375fc2dae1eb54580ab7eda6567
hash1d947084fdf25e07ec8bcdaf0cec508a
hash1e6b601f733bc40eaa58916986bfc5b9
hash4dcfa4317f2111109cd41f457541ed2b
hash5507a3e71aade582dd226b63b1930c56
hash5f3271ba8840be547b1f3a42ea28ebe0
hash602174f6e691d6845ac645b68f1f2538
hash6cae314ddcd821dd2a60dff1fa02460a
hash7d3cce1f9dbaed585b61e6e903d69b9b
hash7e23ffadb664b0e53d821478a249d84c
hash87f7d0b30f7905d282fb464f5ad6c6cf
hash94779909cc510194900c3cc17d1194c8
hash970fc0fcf3bc5a933d10e8413536f27f
hasha1ca53f09b0c6fe3b3b57b5202192d60
hashb3c1a3eebefafe1346c6a864b5423182
hashc8aeca21d10f6bbb78e1f2a67d78fcad
hashca65cc67247d0702ca34eb7b06873bec
hashcbe1743e9aebd3e3002b2b005deb332c
hashd6756063230136f8c55ae27f1a4b0112
hashd9418fb432631021a15fb896b365d608
hashe51ff37fb431767dcdec0b5e6d2a786a
hashfefaefbf09841cef739d090305edc7a4
hash0190940243f6535f51d43edafac943d493159e14
hash0fe3cf4cabadedb382b0833dcb6ba74db3242022
hash168caccbe59473091aa4fbbebba6257aed17985e
hash33e9e5463c12c0a21a7ab37fb7496ab2c5c40bb4
hash3549f6df9c14b70d2308b7b12033218e77fe1dc7
hash44068866546ffea6ef8ab8a639c2151b13f9fd6e
hash4a2658c66f3aeabdb05f56ba88d587683319ce6d
hash53d41445e176bf53c5acd2dad533eda612b05855
hash5d3cde9f6971ec35431cbb113b6b4bc292ea5db0
hash5dd86e22b882d52c67d274e3297694009d13fb96
hash6d9817f5066be757f5f09b067a80fed3cfe280f6
hash6dd639542464a647e3816af896fb1320aff64ba5
hash6fcf829720f425f81a6b35ac5f05fa94775429eb
hash704119320f7ed10dc7707833218468d455d3c5fd
hash7ee579a1fa697f66d80103a867cf706f67bba32b
hash87dcba4957396a9e594ed1d133bc115315763002
hash8c6b6236420c876989af36e3a9e648a00f3000c9
hash9108466c98df01033371483a789a0c23372c52f2
hash9391928e5163ff791c1b4bc535f4ac92510810a6
hashaf9d13e27c8eedc30dd78f237013b239cf23f35d
hashba3874ca96f9bca1daff22ef49ea7505d52b40d4
hashef3f7292cb2f91f9a34953b875eb018b3ef889d2
hashf269488e2128128f234ee2e996489317bfa4720b
hashfec45095576d13a20a6d42096fcadc2d8f6dddd8
hash0d74156089292eee308017c8e8a7550739ecb6149ff379810f7c54b1dbaabc91
hash138a4c9cd617912c2269fae64b6b12d57e926a36c2c62f25ee05a32cdf102212
hash2640fc95373dd299cc61966c2df5ba9e013280ee02944d11bb4d1f70ee57aa30
hash2deeeda412c40ad515dca940916a376d187219ed09ed697b4be4879b7091ec53
hash3befcca381deb6b492aa0c4eba222c29a25192aeacbf2315798c4754a4b74e81
hash3f1313c813e51edf5734d9fb99eb93d6c3aa6c309e3f0a6a4878291c5b2ec73b
hash4a3aa8f4f0eb37be9778fbdf0b7dd282fc407557da61735d2ae9cfc73ee2aa81
hash4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405
hash65359388b49ae2a982111ebe8ac837d0f3294ceab7a712df20d0f6c19bf3029e
hash65e2dbe5c6b670f663d93fd65608470091a231803b4f449bb00e99ebf76eddb7
hash6ddd145622cde2d2f91dace7e1f7edef22f4d49d3645fa9ad4bdb772829c30bf
hash7477f4f25d1cfc3dfb1267e35ab4bcf0b30b8c7ec9677a8d1849ee7d17bc15aa
hash8219453084f370cee43aafe27b9def6b9d3d75fb31bacd7e2fa1d82d617f26dd
hash844108a626c15395059efa355a66c8462af0c822d8219b35b6038d9d42dcf61d
hash8ad63d4d30cd28391318e26f4e9464f302b0a12675a721967d4f2173ed6cfe8a
hashbb56792212abe160fff643631fb69b2081601e6310fc6669fd9d52d690ec1903
hashc9e5cbc98e91aa35a260a1f85d7a5605dc7aa8d2d0b71eb6f063147d4dfa1b5f
hashcbe9e32393529cd79e19a639a1d2da93fba06082be2bdb0c04241f269f98c773
hashd2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e
hashd40d730bcfa4cc7f1ee070f6ce863b03acb81af0a4d66feaec285e1205258b35
hashe8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc
hashe9d2e4e8fac6420ca3b3a3a63a3d313dcfb236a24a11889d6923dd9b42a777d4
hashec9d3e32a4e78f8cc9581f5cf030f0594debee1ce67d2d0759aff3ec1c720b35
hashffceb438127725a6a664aba5021f7625bd8c22b3f76447de91b728839136c9c3
hash2965817d063f1e8f9889f9126443d631
hash8e9e81d1b252d7fa99579e9cf2e4b4ba
hash43d9af0c411110905ab4ddf4e4f713101c74d9de
hashc4e194747d9a268ff56ac1f0708745cbcc164751dcaa24f1a5a15acbe9c4d998
hash0aee700463efe5155d816b0f4d44edc9f4b4579156159b361d1f663b4143c4fd
hashb2f6f40570ac9085b5463fdb623560de
hash88a8d118ee190ac36cf684c2992f6ddd2dda517b
hash47fa634b13b8ba35bd5669da3059a0c7577911c16584a2ff173368f848825de4
hash7402f2f9263782a4c469570035843510
hash3e7a2fcef1d038d05b20148c573a6499
hashd70ebf20e3d697897bad5bebf72ea271
hashf8b5554808428291acc65d1fd2efe01c
hasha3394ef7ffa7e88b2e7efaee4617fe04
hashebdd9595b79b39f53909d862499dbc94
hash481c5b5e69a08c3df206c59fd8ddc0dc
hashb9086413e7b6a0c6a11c25d14c22615f
hash2fa0eb74f8a527d938f8538d66bcdebcc9771527
hash067d93741bcab16810ef15c11941245229519470dc7b24793dd1d3a7addacaae
hash5380ffda12f97cf4d8e0fe02e0580aa1a48b4b6da95e7f8a30029ad125c51b3f
hash2b11bccdea89d428610c15bea1fba417ab8681a6
hashb66bd18de204d405500dc079876b7cbf
hashb0308c91a56209222b178e7099ee03a7b0d06a0e473f042fb2d3c144a07484fa
hash88816b1262eaf819edebb93dc883b3082cc64c34
hashbe98163e7fea224af382a2251252ce4d
hash886d04b78017f721ed458158e3c31300cb7f9d512481a50f21461711438e1c5e
hashac5939a17ec6455b6b7ae0f04c5b71b1db0d00c5
hash42215c1fb55d945b4d2a0bb188ca4dcf
hash58fb875fedf57055c3fedf59fdedb9ebffbf452a0f7f21608abb069cc13effb9
hashea7071abca429f28bfe629a913513c6d604771f4
hash4dd0cbdad60e65fb8cd6999bd9359444
hasha85ce7dde7f83f116436adbdaa8e782e3af0f0ce87ec6534ec7b8ea83bb33eed
hash292887ea4406fce26773992af0bd7dc34951aa84
hash66fd60d03613decacc3c42d94dd9aab8
hash5f899031ec31431ff0f5fcaf4ccf5cd9484b2066
hash26892452f724581530c45287c8b7bc67

Url

ValueDescriptionCopy
urlhttps://ams1.vultrobjects.com/micbucket/Temp/0412.mp4
urlhttps://sgp1.vultrobjects.com/jttrepijgdb/Artificial%20intelligence.pptx
urlhttps://sgp1.vultrobjects.com/jttrepijgdb/efg_d4.zip
urlhttps://ppt1.sgp1.vultrobjects.com/myvideo.mp4
urlhttps://ppt1.sgp1.vultrobjects.com/RuntimeSSH_def7.zip
urlhttps://sgp1.vultrobjects.com/downloads/pictory/Pictory_premium_ver9.0.4.exe
urlhttps://ppt1.sgp1.vultrobjects.com/RuntimeSSH_17.zip
urlhttps://micbucket.ams1.vultrobjects.com/Exclude/Telegram.exe

Threat ID: 6aacf37355bf5e2cf5b8f22b

Added to database: 09/18/2026, 08:16:51 UTC

Last enriched: 09/18/2026, 08:31:44 UTC

Last updated: 09/18/2026, 08:31:44 UTC

Views: 6

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

External Links

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses