HEAVYGRAM: A Telegram-based Surveillance Backdoor Linked to Handala Hack

Reported 17 Sep 2026 by otx · Severity: medium

Analysis reveals HEAVYGRAM, a multi-stage Windows backdoor attributed to Iran-linked threat actor Handala Hack, deployed since Fall 2023 targeting Iranian dissidents, journalists, and government opponents. The surveillance tool uses Telegram bot API for command-and-control operat