HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

What it is

HEAVYGRAM is a Python/PyInstaller Windows backdoor used by Handala Hack (assessed as a false-flag front for Iran-aligned Void Manticore/Storm-0842) since at least September 13, 2023. The companion loader CRUDEEXCLUDE adds Windows Defender exclusions ahead of HEAVYGRAM deployment. Group-IB's research extends a March 19, 2026 US DOJ affidavit and March 20, 2026 FBI FLASH report, adding 29 newly identified samples.

How it works

Delivery occurs via four variants, all requiring the C: drive to exceed 50GB before executing (likely a sandbox-evasion check):

• WSF/VBS scripts running a PowerShell cradle that downloads a decoy PPTX and a ZIP from Vultr Object Storage, extracting the implant (RuntimeSSH.exe) to C:\ProgramData\ssh-cache-default\{guid}\.
• HTA files with an embedded decoy MP4, running VBScript that checks in via Telegram bot API, then polls getUpdates in an infinite loop; a BringContent function downloads attachments and either extracts a ZIP to C:\ProgramData\Kee_Pass and launches KeePass.exe, or runs the file directly if non-exe.
• Delphi .scr droppers (e.g., a Persian-named "Supplementary and expelled list" screensaver) with an embedded RCDATA resource dropped as Runtime_SSH.zip, extracting and launching RuntimeSSH.exe, paired with a decoy document.
• CRUDEEXCLUDE Delphi executables mimicking Pictory/Telegram UIs, which add three Defender exclusion paths via PowerShell, decode a base64 resource from %APPDATA%\downloaded_file26.txt into ExtractedFile26.dat, rename it File26.zip, extract to C:\ProgramData\SMQDServicePackages\488ht1-8ww648q, and launch the implant via CreateProcessW.

The persistent implant stores config at %APPDATA%\Config\config.xml and uses a mutex for single-instance enforcement. Two Telegram-driven handlers: analyze_command routes text by prefix — @@ runs arbitrary commands via os.popen and returns output; ** writes message body to C:\ProgramData\ur.txt; ## triggers a backdoor command suite. downloader handles attachments by filename pattern: DLLs prefixed dev/bit/kee are side-loaded by copying the legitimate bthudtask.exe into a spoofed C:\Windows \SysWOW64\ (trailing space) directory, then deleting the spoofed path after execution; ZIPs prefixed reg extract to the SMQDServicePackages path; generic ZIPs/EXEs land in %APPDATA%\SMQDService. C2 uses send_initial_message (beacons the full domain name) and send_health_msg (24-hour heartbeat), over either single-bot or dual-bot (check-in bot + separate logging/polling bot) Telegram configurations.

Preconditions / Affected

Windows hosts; initial access requires the victim to execute a first-stage file delivered via Telegram social engineering (masquerading as Telegram, KeePass, WhatsApp, or Pictory apps). Sandbox/VM evasion check requires C: drive >50GB to proceed.

What to do

• Isolate hosts matching listed IOCs (file hashes and network indicators are provided on the page).
• Audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent for unauthorized entries.
• Search for the spoofed directory pattern C:\Windows \ (trailing space).
• Review outbound traffic to api.telegram.org for anomalous bot API calls; block/monitor this endpoint at the perimeter where Telegram isn't a sanctioned business tool.
• Deploy detection for bthudtask.exe execution outside its legitimate path, directory creation with trailing spaces, os.popen/shell invocations from non-standard processes, and unauthorized access to %APPDATA%\Telegram Desktop / TelegramMessengerLLP.
• Restrict execution from %APPDATA%, C:\ProgramData, and other user-writable paths via application control; enforce code-signing validation to block unsigned DLL side-loading.

Caveats

Attribution to Handala Hack is held at moderate confidence, based on the DOJ affidavit's probable-cause linkage, Iran International's July 2025 confirmation of Telegram-account compromises aligning with HEAVYGRAM's session-data exfiltration capability, and tradecraft overlap (Vultr Object Storage, Persian-language decoys, Delphi tooling) — not direct technical proof. Much of the identified Telegram C2 infrastructure (bots, users, groups) remains live as of 2026 rather than taken down, though some accounts have since been taken over by unrelated actors.