Full Report
The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,
Analysis Summary
# Threat Actor: Handala Hack
## Attribution & Identity
* **Identification:** Handala Hack is an online "hacktivist" persona assessed to be operated by **Void Manticore**.
* **Affiliation:** Linked to Iran’s Ministry of Intelligence and Security (MOIS).
* **Aliases/Associated Groups:**
* Void Manticore
* Banished Kitten
* Red Sandstorm
* Storm-0842
* **Co-Tracking:** The U.K. NCSC tracks the associated malware family as **CHOSEN BRICK**.
## Activity Summary
Handala Hack emerged shortly after the October 7, 2023, attacks in Israel. The group is currently active in conducting surveillance, data exfiltration, and "hack and leak" operations. Recent activity (mid-2024) involves the deployment of the **HEAVYGRAM** backdoor and the **CRUDEEXCLUDE** utility, often masquerading as legitimate software installers to compromise targets.
## Tactics, Techniques & Procedures
* **Social Engineering:** Uses Telegram, WhatsApp, and Instagram to build rapport with targets under the guise of technical support or trusted contacts.
* **Masquerading:** Delivers malware disguised as legitimate installers for applications like Pictory, KeePass, and Telegram.
* **Defense Evasion:** Uses the Delphi-based utility **CRUDEEXCLUDE** to configure Microsoft Defender exclusion paths to prevent detection of malicious payloads.
* **Persistence:** Establishes persistence via Windows autorun Registry keys.
* **Command & Control (C2):** Utilizes Telegram as a C2 platform, parsing messages using specific delimiters (`@@`, `**`, `##`) to execute commands.
* **Execution:** Employs DLL sideloading and PowerShell execution.
* **Information Stealing:** Capability to record audio (microphone), take screenshots, steal browser passwords, and exfiltrate Telegram/WhatsApp session files.
## Targeting
* **Sectors:** Journalism, Political Opposition, Government.
* **Geography:** Primarily Iran (dissidents), Israel, and potentially international targets involved in Iranian affairs (e.g., Canada, UK).
* **Victims:**
* Iranian dissidents and opposition groups.
* Five journalists from *Iran International*.
* Targets in Southern Israel.
## Tools & Infrastructure
* **HEAVYGRAM:** A Python-based surveillance backdoor controlled via Telegram.
* **CRUDEEXCLUDE (CHOSEN BRICK):** A Delphi-based utility used for environment preparation and defense evasion.
* **Malware Capabilities:** Remote command execution, data exfiltration, microphone activation, and password theft.
* **C2 Infrastructure:**
* Telegram Bot API
* api.ipify[.]org (for IP discovery)
## Implications
Handala Hack represents a sophisticated blending of state-sponsored espionage and psychological operations. By operating under a "hacktivist" persona, the MOIS can conduct destructive wiping attacks or leak sensitive information to inflict reputational harm while maintaining a degree of plausible deniability. The use of widely trusted messaging platforms for both social engineering and C2 makes their operations difficult to distinguish from legitimate traffic.
## Mitigations
* **Application Whitelisting:** Restrict the execution of unverified Delphi-based utilities and unsigned Python executables.
* **Defender Monitoring:** Monitor for unauthorized changes to Microsoft Defender exclusion lists (specifically via PowerShell or Registry).
* **Communication Policy:** Educate high-risk individuals (journalists/dissidents) on the risks of accepting technical support or file transfers via Telegram and WhatsApp.
* **Network Filtering:** Monitor and potentially restrict traffic to known Telegram Bot API endpoints if not required for business operations.
* **Endpoint Detection:** Deploy EDR solutions to detect DLL sideloading and anomalous persistence mechanisms in the Windows Registry.