Handala Hack's HEAVYGRAM Backdoor (CHOSEN BRICK) Spies on Iranian Dissidents via Telegram C2

Executive Summary

On September 15, 2026, the UK National Cyber Security Centre, the US Federal Bureau of Investigation, and the Netherlands' General Intelligence and Security Service (AIVD) published a joint advisory on a Telegram-controlled Windows backdoor the FBI calls HEAVYGRAM and the NCSC calls CHOSEN BRICK.¹ The advisory expands on an FBI FLASH alert first issued March 20, 2026, adding new technical detail and indicators of compromise.² The malware is deployed by Iranian state cyber actors operating under the online persona Handala Hack, and is used to collect a target's emails, chat messages, screenshots, and microphone audio for the purpose of tracking dissidents, journalists who oppose the Iranian government, and activists.¹

The NCSC dates confirmed targeting to at least 2025, with victims identified in the UK, US, and Netherlands; the FBI separately dates the wider Handala Hack Telegram-C2 campaign to autumn 2023.¹² Delivery relies on sustained social-engineering rapport-building over Telegram, WhatsApp, and Instagram, with the payload disguised as legitimate software — Pictory, RunwayML, Norton Antivirus, Telegram itself, Adobe Flash Player, KeePass, or fabricated MRI scan results.¹ A companion Delphi-based staging tool, CRUDEEXCLUDE, prepares the victim machine by carving Microsoft Defender exclusions before HEAVYGRAM or a related family, SHADEGENES, is dropped.³

Handala Hack is assessed to be an online persona of Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842), an Iranian Ministry of Intelligence and Security (MOIS)-affiliated actor.³ The FBI has separately assessed that Handala Hack is operated by the same MOIS cyber actors as another persona, Homeland Justice.⁴ This is the same actor line the US Justice Department disrupted in March 2026 by seizing four domains used for "faketivist" psychological operations, and the same actor a hacktivist-styled Telegram manifesto credited with a mass data-wiping incident against medical technology maker Stryker days earlier.⁴⁵

The advisory's own framing is stark: stolen data has been used to build a "pattern of life" on individual targets, personal details of past victims have surfaced on pro-Iranian leak sites, and in some cases Iranian intelligence services are assessed to have plotted to kidnap or conduct lethal operations against people abroad whom the regime considers enemies.¹ A September 2025 Canadian government advisory documents one concrete instance: the doxxing of five journalists from Iran International, including a Canadian resident whose government ID and passport details were published and who subsequently received violent threats.⁶

Verification of Claims

1. Claim: HEAVYGRAM and CHOSEN BRICK are the same malware family, named independently by the FBI and the NCSC. → Verified — both agencies co-published the September 15, 2026 advisory describing one malware family under both names.¹²

2. Claim: The malware persists via Windows Registry Run keys and disables Microsoft Defender scanning on its staging paths. → Verified — the NCSC's own technical analysis documents both behaviors with ATT&CK mappings T1547.001 and T1685.¹

3. Claim: Each infected device communicates with its own dedicated Telegram bot. → Verified — stated independently by the NCSC (as an "Operational Security precaution") and by Group-IB via The Hacker News.¹³

4. Claim: Handala Hack is the same MOIS operation as the Homeland Justice persona. → Partially verified — this is the FBI's own assessed attribution, not an admission or forensic certainty; it is the agency's confidence-graded judgment, not an independently corroborated fact.⁴

5. Claim: The malware campaign has been active since autumn 2023. → Partially verified — the FBI dates the wider campaign to autumn 2023, while the NCSC's advisory describes confirmed targeting "from at least 2025"; the two dates describe different things (campaign origin vs. confirmed victim window) but are reported inconsistently across coverage of the same joint advisory.¹²

Timeline

Attack Anatomy

Reconnaissance and initial contact

Operators research targets in advance (T1589) and approach them via Telegram, WhatsApp, or Instagram, posing as a known contact or as platform technical support (T1566.003).¹ Rapport is built over an extended period before a file is sent.

Delivery

The lure file matches the social-engineering pretext: fake installers for Pictory, RunwayML, Norton Antivirus, Telegram, Adobe Flash Player, or KeePass, or files disguised as MRI scan results.¹ Opening the file triggers user execution of the malicious payload (T1204.002) while a convincing decoy screen displays in the foreground. Operators typically target a work device first, then attempt to move to the victim's personal device if corporate controls block the initial attempt.¹

Installation and defense evasion

CRUDEEXCLUDE, a Delphi-based GUI utility masquerading as a legitimate app, stages the environment by adding Microsoft Defender exclusion paths (T1685) so the next-stage payload is not scanned.³ HEAVYGRAM itself then establishes persistence via a Windows Registry Run key, most commonly HKCU\Software\Microsoft\Windows\CurrentVersion\Run (T1547.001), using entry names such as SMQDService or winappx.¹ Delivery to this stage has been observed via WSF/VBS scripts, VBScript/HTA files, executables with embedded archives, and CRUDEEXCLUDE-staged archives.³

Command and control

Once installed, HEAVYGRAM/CHOSEN BRICK connects to a Telegram bot for C2 (T1102.002); each victim is assigned a unique bot ID to prevent cross-contamination between infections.¹ Group-IB's analysis documents a prefix-based command parser: @@ executes arbitrary OS commands, ** writes message content to a local file, and ## unlocks a backdoor command suite (runexe, whois, runtro, cht, regtro, reg, dt) for process execution, secondary trojan delivery, C2 token rotation, and Telegram Desktop data theft.³ Newer samples route Telegram traffic through HTTPS/SOCKS5 proxy services to obscure the C2 channel (T1090.002).¹

Actions on objectives and exfiltration

The malware enumerates running processes and system information (T1057, T1082), captures the screen (T1113), records audio via the microphone (T1123), copies browser-stored Telegram and WhatsApp data (T1005), steals saved passwords (T1555.003) and local email content (T1114.001), downloads further payloads, deletes files, and — in at least one observed sample — can wipe the entire system (T1485).¹ Stolen data and files are exfiltrated through the Telegram bot (T1041) and, in some configurations, cloud object storage such as Vultr Object Storage and Storj (T1567.002).¹

Threat Actor Profile

Persona: Handala Hack (Handala Hack Team) Assessed operator: Void Manticore — also tracked as Banished Kitten, Red Sandstorm, and Storm-0842 Affiliation: Iran's Ministry of Intelligence and Security (MOIS) Attribution confidence: Moderate confidence per Group-IB; the FBI and DOJ attribute the underlying infrastructure directly to MOIS without a stated confidence qualifier, describing it as a state-directed operation.³⁴

Handala Hack emerged shortly after the October 7, 2023 Hamas-led attacks on Israel and has run a mix of destructive wiping, hack-and-leak, and now long-running Telegram-C2 surveillance operations.³ The FBI assesses Handala Hack is operated by the same MOIS cyber actors as a second persona, Homeland Justice — a link recorded in the seizure-warrant affidavit supporting the March 2026 domain takedown.⁴ Prior operations attributed to the persona include:

• The March 2026 Stryker wiper incident, in which a Telegram manifesto claimed the erasure of 200,000+ systems across offices in 79 countries; a source told KrebsOnSecurity the mechanism was likely abuse of Microsoft Intune's remote-wipe capability rather than custom destructive malware, and the American Hospital Association said it had no confirmed reports of US hospital disruption as of the initial reporting.⁵
• The March 2026 DOJ domain seizures, which found the seized sites used to post PII on roughly 190 individuals linked to the Israeli Defense Force and government, and to send death threats — including one email offering a $250,000 bounty and referencing coordination with a Mexican cartel — to Iranian dissidents and journalists.⁴
• The 2025 hack-and-leak operation against five Iran International journalists, publishing government ID, passport, and permanent-residency documents and leading to violent threats against a Canadian resident and harassment of family members still in Iran.⁶

MITRE ATT&CK techniques observed:

OPSEC: Per-victim Telegram bot IDs to prevent cross-contamination; HTTPS/SOCKS5 proxying of newer C2 traffic; the malware is Windows-only and has not been observed with automated lateral movement.¹

Technical Indicators

registry_persistence:
  - path: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run'
    observed_value_names:
      - SMQDService
      - winappx
staging_path:
  - 'C:\Windows \SysWOW64'   # non-standard: note the space after "Windows"
c2_and_infrastructure:
  - api.telegram[.]org
  - vultrobjects[.]com
  - storjshare[.]io
  - backblazeb2[.]com
  - iproyal[.]com
  - lightningproxies[.]net
mutexes:
  - ytyjyujyu
  - noi672pp434awkc12f
lure_filenames_observed:
  - Pictory (AI video app)
  - RunwayML
  - Norton Antivirus
  - Telegram
  - Adobe Flash Player
  - KeePass
  - "MRI scan results"
note: >
  Full file hashes are published in the FBI's technical analysis and the
  NCSC/FBI/AIVD joint advisory (see Sources); they are not reproduced here
  because the agencies warn filenames and staging paths change between
  campaigns and should not be treated as the only indicators to monitor.

Legal and Regulatory Response

The UK NCSC, US FBI, and Netherlands AIVD jointly published the CHOSEN BRICK/HEAVYGRAM technical advisory on September 15, 2026, updating the FBI's original FLASH-20260320-001 alert from March 20, 2026 with new indicators and analysis, and issuing shared mitigation guidance for individuals and network administrators.¹²

Separately, on March 19, 2026, the US Justice Department announced the court-authorized seizure of four domains — justicehomeland[.]org, handala-hack[.]to, karmabelow80[.]org, and handala-redwanted[.]to — tied to the same MOIS actor line, describing a "playbook" of destructive cyberattacks paired with "faketivist" psychological operations. The Department of State's Rewards for Justice program concurrently offered up to $10 million for information on state-directed actors conducting malicious cyber activity against US critical infrastructure.⁴ In September 2025, the Canadian Rapid Response Mechanism separately published an assessment of the Iran International journalist doxxing operation attributed to the same persona.⁶

Impact Assessment

• Confirmed: Personal identifying documents of five Iran International journalists, including one Canadian resident, were published and led to documented violent threats and family harassment — per Canadian government assessment.⁶
• Confirmed: Four Iran-linked domains used for hacking claims, PII posting, and death threats were seized by US authorities in March 2026.⁴
• Reported, not independently confirmed: Handala Hack's own claim of wiping 200,000+ systems across Stryker offices in 79 countries; independent reporting corroborates operational disruption at Stryker's Cork, Ireland site and a company-wide network outage, but the American Hospital Association reported no confirmed US hospital service disruptions as of initial coverage.⁵
• Unknown: The total number of individuals compromised by HEAVYGRAM/CHOSEN BRICK specifically (as distinct from the Stryker incident or the journalist doxxing case); neither the NCSC nor the FBI has published a victim count in the September 2026 advisory.¹²

Lessons and Defensive Recommendations

For SOC/defenders:

• Alert on new entries to HKCU\Software\Microsoft\Windows\CurrentVersion\Run, particularly non-standard service-like names such as SMQDService or winappx.
• Flag Microsoft Defender exclusion-path changes made outside of change-management tooling, especially on endpoints belonging to at-risk personnel (journalists, activists, dissidents, executives with public profiles).
• Monitor outbound connections to api.telegram.org from endpoints with no legitimate business reason to use it, and treat unexpected traffic to Vultr Object Storage or Storj endpoints as suspicious on non-developer machines.

For at-risk individuals:

• Treat unsolicited installer files from messaging-app contacts as hostile by default, even when the sender appears to be someone known, per the NCSC's warning that operators impersonate trusted contacts and platform support.¹
• Assume a compromise on a work device may be followed by a second attempt on a personal device; apply the same scrutiny to both.

For platform/cloud teams:

• Telegram's Bot API and consumer cloud storage services (Vultr, Storj, Backblaze) are being used as durable, low-cost C2 and exfiltration channels precisely because they are legitimate infrastructure; detection strategies built solely around "known-bad domains" will miss this pattern.

For leadership:

• The Stryker incident is a reminder that identity and device-management platforms (Microsoft Intune, in the reported case) are a viable mass-disruption vector on their own, without any purpose-built destructive malware — access-control review of MDM admin roles is as relevant to ransomware/wiper readiness as endpoint detection.

Sources