GROUP-IB researchers have identified 29 new samples of the HEAVYGRAM malware targeting Iranian dissidents, Farsi-language journalists and academics. The campaign is associated with Handala Hack, which analysts assess with moderate confidence may be an online persona of Void Manticore, also known as Storm-0842, Banished Kitten and Red Sandstorm. The group is assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS), although the attribution remains qualified.
The malware is delivered through social engineering, including archives disguised as Telegram, KeePass and video-editing software, as well as Windows Script Files, HTML applications and Persian-named screensavers. Some samples check whether the primary disk exceeds 50GB before downloading further components. Trojanised Delphi applications can add malicious folders to Windows Defender exclusions, while scripts use PowerShell and registry autorun keys to establish persistence. The main implant is a Python executable packaged with PyInstaller and can use DLL side-loading.
HEAVYGRAM uses Telegram bots, users and groups for command-and-control and data theft. Operators can issue shell commands, capture screenshots, collect running processes and steal Telegram Desktop session files to hijack accounts. Group-IB said identified Telegram infrastructure was still present in 2026, though some accounts had been taken over by unrelated actors.
Defenders are advised to monitor PowerShell commands that modify Defender exclusions, restrict unverified scripts, inspect Telegram Bot API traffic and changes to Telegram Desktop data folders, and enforce multi-factor authentication on corporate communication accounts.