Handala Hack Deploys HEAVYGRAM Through Social Engineering and Defense Evasion
The Iran-linked threat actor known as Handala Hack has been observed using a multi-stage malware campaign involving HEAVYGRAM and CRUDEEXCLUDE to target individuals and organizations of interest. Researchers said the activity relies heavily on social engineering, application masquerading, defense evasion, and persistent access.
Attackers reportedly contact targets through Telegram, WhatsApp, and Instagram while posing as trusted contacts or offering technical assistance. Victims are then persuaded to execute seemingly legitimate applications disguised as software such as Telegram, KeePass, or Pictory. These installers can contain additional malicious payloads, including HEAVYGRAM.
CRUDEEXCLUDE is used to prepare the victim environment by creating staging directories and adding paths to Microsoft Defender exclusions, allowing subsequent malware to operate with reduced detection. The malware can also use PowerShell to establish persistence through Windows Registry autorun keys.
HEAVYGRAM provides attackers with extensive remote access through Telegram-based command and control. Its capabilities include executing commands, launching processes, collecting system and network information, capturing screenshots, stealing browser and messaging application data, transferring files, downloading additional malware, and deleting files.
Researchers said HEAVYGRAM can maintain access by periodically communicating with its Telegram infrastructure and sending system information to operators. Attackers can also modify C2 configuration and deploy additional payloads remotely.
The campaign demonstrates how trusted communication platforms, legitimate-looking applications, and security-control exclusions can be combined to establish persistent access while reducing the likelihood of detection.
Attack Surface
Endpoint, Messaging, Infrastructure
Tactics
Command and Control, Collection, Defense Evasion, Exfiltration, Persistence, Initial Access, Execution, Discovery
Techniques
- T1102.002 – Web Service: Bidirectional Communication
- T1071.001 – Application Layer Protocol: Web Protocols
- T1573 – Encrypted Channel
- T1005 – Data from Local System
- T1041 – Exfiltration Over C2 Channel
- T1547.001 – Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1562.001 – Impair Defenses: Disable/Modify Tools
- T1036 – Masquerading
- T1204.002 – User Execution: Malicious File
- T1566 – Phishing
- T1113 – Screen Capture
- T1574.002 – DLL Side-Loading
SuperPRO's Threat Countermeasures Procedures
- Application control / allow-listing: block execution of unsigned binaries from user-writable locations (%APPDATA%, %ALLUSERSPROFILE%/C:ProgramData, Downloads), where HEAVYGRAM/CRUDEEXCLUDE stage and run.
- Monitor and lock down Defender exclusions: alert on any new exclusion path being added (CRUDEEXCLUDE’s core behaviour); audit existing exclusions for suspicious paths such as %ALLUSERSPROFILE%MicrosoftDistributionsysmain. Use tamper protection so exclusions cannot be changed by non-admins.
- Hunt the signature artefacts: directories created with a trailing space (e.g. "C:Windows "), and bthudtask.exe running from non-standard paths or side-loading unsigned DLLs.
- Detect the Telegram C2: monitor outbound HTTPS to api.telegram.org from hosts/servers with no legitimate Telegram use; where Telegram is not needed for business, block it at the proxy.
- Audit persistence: review HKCU…CurrentVersionRun (and equivalent) autorun keys for unexpected entries; alert on PowerShell writing Run keys.
- Constrain scripting: PowerShell ConstrainedLanguage mode + script-block/module logging to catch the persistence and payload steps.
- User awareness (highest-value control here): warn staff — especially journalists, NGO, diaspora and policy roles — about unsolicited Telegram/WhatsApp/Instagram contacts posing as known people or “tech support” and pushing installers disguised as Telegram, KeePass, Pictory or WhatsApp. Never run software received via chat.
- IOC blocking + IR readiness: load the Group-IB hashes/IOCs into EDR/SIEM; if found, isolate the host, capture memory, and reimage — then rotate credentials for browsers and messaging apps that HEAVYGRAM harvests.
