The Hacker News reports that the Iran-linked hacktivist persona known as Handala Hack is employing a sophisticated surveillance backdoor named HEAVYGRAM, which operates via Telegram, and a utility called CRUDEEXCLUDE.HEAVYGRAM is a versatile tool capable of remote command execution, system and network information discovery, data exfiltration, screenshot capture, and establishing persistence through Windows registry keys. CRUDEEXCLUDE, a Delphi-based utility, prepares environments for HEAVYGRAM deployment by masquerading as legitimate applications and configuring Microsoft Defender exclusions for defense evasion. This activity aligns with U.S. FBI alerts regarding Iranian cyber actors targeting dissidents and opposition groups for intelligence gathering and reputational harm. The U.K. National Cyber Security Centre tracks similar malware under the moniker CHOSEN BRICK.Attacks typically involve social engineering via messaging platforms like Telegram to deliver malware disguised as harmless installers. Handala Hack, linked to Iran's Ministry of Intelligence and Security (MOIS), has a history of destructive attacks and hack-and-leak operations. HEAVYGRAM leverages Telegram for command-and-control, enabling various malicious actions including file exfiltration and the execution of secondary payloads. Delivery methods include WSF/VBS scripts, HTA files, and executables with embedded archives, often utilizing CRUDEEXCLUDE for staging.Source: The Hacker News
