In December 2023 somebody in Germany uploaded a Windows screensaver file to a public malware analysis service. Its name was in Persian and it translated to "Supplementary and expelled list". Opening it produced exactly what the name promised: a plain text document headed "Expelled students", listing three people by first name, last name, student number, major, enrollment year and degree level. While the reader looked at that list, a backdoor unpacked itself and started reporting to a Telegram bot.
The document was bait, cut to fit one very specific reader.
Researchers at Group-IB published an analysis on September 17 of that malware family, which they track as HEAVYGRAM, saying they had identified 29 previously undocumented samples along with their loaders and payloads. The work is credited to Karam Chatra, Batuhan Karakoç and Mahmoud Zohdy. They attribute the implant with moderate confidence to Handala Hack, the Iran-linked persona that has spent two years branding itself as a pro-Palestinian hacktivist collective. According to the public record the research builds on, it has been used since the autumn of 2023 against Iranian dissidents, journalists and people whose views run counter to the government of Iran.
HEAVYGRAM itself is not exotic. It is a Windows backdoor that takes screenshots, records audio, steals files, runs whatever its operator types, and survives a reboot. What makes it worth a close look is everything around it: who it was aimed at, what the lures reveal about the people picking targets, and the fact that its entire command channel is a Telegram bot.
A lure cut for a Persian-speaking reader
The screensaver from December 2023 was written in Delphi and carried the backdoor inside itself as an embedded archive. Before unpacking anything it checked that the machine's C: drive was larger than 50GB, a crude test for whether it had landed on a real computer rather than an analyst's disposable sandbox, and refused to continue without internet access. Only then did it drop its archive and launch the implant inside, under the filename RuntimeSSH.exe.
A later variant, submitted from Germany in April 2025, wrapped the same idea in an HTML application with a video embedded in it. The video's own metadata records it as created on April 12, 2025, and Group-IB assesses it was shot in Iran. There is no intelligible speech in it. What is visible are the logos of two Iranian organisations, the Imam Khomeini Relief Foundation and the Emdad-e Velayat Qard al-Hasan Fund.
Other first stages simply impersonated software people already trust. The team documented installers built to look like KeePass, like Telegram itself, and like a premium edition of the AI video tool Pictory, some copying the real application's interface. Public disclosures describe victims being approached over messaging apps by operators posing as someone they knew or as technical support.
What the Justice Department already put on the record
The research builds on a United States government action from earlier this year, and that action is worth reading directly rather than through a summary. On March 19, 2026 the Justice Department announced the court-authorised seizure of four domains: Justicehomeland[.]org, Karmabelow80[.]org, Handala-Redwanted[.]to and Handala-Hack[.]to.
The department's own announcement is blunter about the purpose than any malware report can be. It states the domains were used by Iran's Ministry of Intelligence and Security in psychological operations that included "calling for the killing of journalists, regime dissidents, and Israeli persons", and describes emails that openly solicited cartel contacts to carry out violence, offering a quarter of a million dollars for killing and beheading named targets. It also records that the Handala-hack[.]to domain was used to claim credit for a destructive malware attack in March 2026 on a United States multinational medical technologies firm.
Read next to that, an implant that quietly collects screenshots and Telegram session data stops looking like ordinary espionage tooling. It looks like the collection end of a programme whose published output is threats against the people it collects on. The supporting affidavit named the malware directly and identified RuntimeSSH.exe as a second stage on a victim's machine, and the FBI followed a day later with a FLASH report carrying twelve file indicators.
Telegram does all of the work
Rather than build command infrastructure, the operators rented it from a consumer messaging app. The second stage is written in Python and packed with PyInstaller. On startup it reads a Telegram bot token and an operator account ID from its own config file, collects the machine name, and announces itself, then sends a heartbeat every 24 hours to confirm it is still alive.
Group-IB's assessment of why this is attractive is the practical one: Telegram gives operators an encrypted channel with low setup, maintenance and rotation costs. The team observed both single-bot and dual-bot layouts, with several bots, users and groups reused across samples. Much of that infrastructure was still sitting on Telegram in 2026 rather than being torn down, though the researchers note some accounts have since been taken over by unrelated people.
One detail from the infrastructure analysis is harder to read past than the rest. The operator-controlled groups follow a house style: a Persian female name as the title and a portrait of a woman as the picture. At least one of them, Group-IB found, used the real full name and photograph of a female Iranian dissident.
Ten commands and a folder with a space in its name
Once installed, the implant sorts incoming Telegram messages by prefix. Two at-signs passes the message straight to the operating system and returns its output to the chat. Two asterisks writes it to disk. Two hashes selects from a fixed command set: start a process, look up the host's public IP address, launch a second payload, swap in a new bot token and operator ID mid-operation, write either payload into the Windows autorun keys, steal Telegram Desktop's application data, dump system information, list running processes with their privilege levels, or take a screenshot.
Files sent into the chat are handled by a separate routine, and one of its branches is the neatest trick in the report. For certain DLLs, the malware copies a legitimate Windows binary, bthudtask.exe, into a directory named C:\Windows \SysWOW64\ , with a trailing space after Windows. That is a real, creatable path that is not the real system directory. Running the legitimate binary from there causes it to load the attacker's DLL instead of the genuine one, after which the fake directory is deleted. Group-IB also documented a related family it links to public descriptions of CRUDEEXCLUDE, whose job is to add the malware's folders to Microsoft Defender's exclusion list before the implant lands.
What this establishes, and what it does not
The attribution is explicitly moderate confidence, and it rests on three things: a US government affidavit connecting the malware to Handala Hack on a probable cause standard, a 2025 statement from the London-based outlet Iran International that leaked material about its journalists came from intrusions involving compromised Telegram accounts, and tradecraft overlaps with earlier Handala activity. Handala is in turn assessed to be a front for Void Manticore, the destructive actor also tracked as Storm-0842, Banished Kitten and Red Sandstorm, which we covered in our profile of how the persona was built. None of that is the same as a named operator or an indictment, and the report does not claim it is. What the samples do establish is a working toolkit, a delivery chain and an infrastructure pattern, all pointed at a consistent victim profile.
Hunt for the trailing space, then the Telegram traffic
Group-IB's guidance for defenders is unusually actionable, because this tradecraft leaves odd artefacts. Search file systems for that spoofed directory pattern, any path beginning C:\Windows \ with a trailing space, and alert on directory creation with trailing spaces in system paths generally. Audit the Run keys under both HKCU and HKLM for entries you did not put there, and watch for bthudtask.exe executing outside its legitimate path. Review outbound traffic to the Telegram bot API and block it at the perimeter wherever Telegram is not a sanctioned business tool. Restrict execution from user-writable locations such as %APPDATA% and C:\ProgramData, and enforce code signing so unsigned DLLs cannot load. For the individuals actually in the crosshairs the advice is older and simpler: install software only from official vendor channels, and confirm over a second trusted channel that the person messaging you is who they claim to be.
Selected indicators, defanged. Staging and command infrastructure: hxxps://sgp1[.]vultrobjects[.]com/jttrepijgdb/efg_d4[.]zip, hxxps://api[.]telegram[.]org (bot API command and control), hxxps://api[.]ipify[.]org (victim IP lookup). Implant SHA256: d2d19c7f2e4a5fdcfb34b26f048077d2c4fe26637ed2c90e9e9bdf32307c377e. Filenames in the chain: RuntimeSSH.exe, winappx.exe, MicDriver.exe, MsCache.exe, smqdservice.exe. The full report carries the complete set.
The most quietly alarming thing in this research is not the malware. It is the decoys. Somebody had to decide that a list of expelled students, a video of an Iranian charity and the name and face of a real dissident woman were the right things to put in front of these particular targets. That is not a capability you buy. It is a research function staffed by people who know the community they are aimed at, and it is the part of this operation that no patch or detection rule reaches.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.