Iranian State-Linked Group Deploys HEAVYGRAM Malware to Target Dissidents

TEHRAN — A sophisticated cyber espionage campaign attributed to an Iran-linked threat actor known as Handala Hack has been identified, utilizing a new Telegram-based backdoor malware designed to extract sensitive data from opposition figures. The operation, linked to the Iranian Ministry of Intelligence and Security (MOIS), targets journalists, political dissidents, and groups opposing the Iranian government with the aim of intelligence collection and reputational damage.

The malicious software, designated HEAVYGRAM, operates through social engineering tactics to infiltrate devices. Once installed, the backdoor grants attackers the ability to steal passwords, intercept messaging data, capture screenshots, and exfiltrate files from compromised systems. The malware specifically leverages the Telegram platform, a widely used communication tool among activists in the region, to establish persistence and maintain covert access.

Security researchers have associated the Handala Hack persona with several other aliases, including Void Manticore, Banished Kitten, Red Sandstorm, and Storm-0842. These designations point to a coordinated effort by state-sponsored actors to monitor and suppress dissent. The campaign's objectives extend beyond data theft; analysts indicate the group intends to leak stolen information strategically to inflict reputational harm on targeted individuals and organizations.

The timing of the discovery coincides with heightened tensions involving Iranian opposition networks. While the specific scope of the initial infections remains under assessment, the capabilities of HEAVYGRAM suggest a significant escalation in the digital surveillance tools available to Iranian intelligence services. The malware's ability to harvest real-time screenshots and private communications poses a direct threat to the operational security of journalists and activists working outside Iran.

The Handala Hack group has historically focused on targets critical of the regime, employing similar social engineering methods in previous operations. This latest deployment marks a refinement of those tactics, integrating deeper integration with popular messaging applications to bypass traditional security measures. The Iranian government has not publicly commented on the attribution or the existence of the campaign.

Questions remain regarding the full extent of the data already compromised and the number of individuals affected by the HEAVYGRAM backdoor. As the investigation continues, cybersecurity experts are monitoring for further variations of the malware and additional indicators of compromise. The development underscores the evolving nature of state-sponsored cyber operations aimed at silencing opposition voices through digital intrusion.