Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

Iranian hackers associated with the Handala Hack persona have been linked to a Telegram-based backdoor called HEAVYGRAM. This backdoor allows for remote command execution and can steal sensitive information, including passwords. It also enables the discovery of system, network, and process information, as well as the exfiltration of data and Telegram session files. Additionally, HEAVYGRAM can capture screenshots and load DLLs. The hackers have also been tied to a Delphi-based utility known as CRUDEEXCLUDE.