Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

The Iran-linked "hacktivist" persona known as Handala Hack has been attributed to a Telegram-based surveillance backdoor called HEAVYGRAM and a Delphi-based utility known as CRUDEEXCLUDE. "HEAVYGRAM offers builtin commands supporting remote command execution, system, network and process information discovery, data and Telegram session files exfiltration, screenshot capture, DLL sideloading,

Report facts: The article describes Iran-linked hacktivist persona Handala Hack using HEAVYGRAM, a Telegram-based surveillance backdoor, and CRUDEEXCLUDE, a Delphi utility, to enable remote command execution, system and network discovery, data and Telegram session file exfiltration, screenshot capture, and DLL sideloading. These tools support persistent, covert access to compromised systems and communication accounts. RealGround analysis: While the reported malware is not itself an AI system, similar remote access and data-exfiltration tooling can be used to hijack AI agents, steal AI-related credentials, and compromise chat-based workflows (e.g., Telegram-embedded agents). Continuous AI Red Teaming can help organizations simulate such malicious tooling against their AI-integrated communication channels to identify weak points in access controls, session storage, and data-handling before real actors exploit them.