As reported by The Hacker News, Group-IB has definitively linked the Iran-aligned hacktivist persona Handala Hack to the Ministry of Intelligence and Security (MOIS) threat actor Void Manticore, exposing a surveillance infrastructure built around two previously undocumented tools: the HEAVYGRAM Telegram backdoor and the CRUDEEXCLUDE deployment utility. This is not a hacktivist operation — it is state-sponsored intelligence collection dressed in a flag of opportunism.

Threat Intelligence: Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842) has a documented history of destructive wiping attacks and hack-and-leak operations dating back to late 2023.

From Wiper to Spyware: Mission Evolution

Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842) has a documented history of destructive wiping attacks and hack-and-leak operations dating back to late 2023. What Group-IB's findings reveal is a pivot — or more likely a parallel track — toward persistent surveillance. HEAVYGRAM's ability to exfiltrate Telegram session files is particularly significant: stolen session files allow operators to clone a victim's Telegram identity, read encrypted messages from another device, and impersonate the target to their contacts. This enables lateral social engineering without needing to re-deploy malware, dramatically extending the campaign's reach through trusted networks.

The Defender Evasion Problem

CRUDEEXCLUDE's primary purpose — configuring Microsoft Defender exclusion paths before dropping HEAVYGRAM — deserves closer attention from defenders. This is not a zero-day or a kernel-level rootkit. It is a Delphi-compiled utility with a GUI that programmatically adds Defender exclusion entries, effectively creating a blind spot in endpoint protection. The technique is unsophisticated but effective, and it succeeds because it exploits the gap between policy and monitoring: most EDR solutions do not alert on exclusion-path modifications, and most organizations do not continuously audit their Defender exclusion lists.

The threat model here is not a perimeter breach. It is a trusted-contact delivery pipeline that weaponizes the platforms dissidents and journalists already use to communicate securely — then neutralizes the endpoint security meant to detect the payload.

Who Is at Risk

The Defender Evasion Problem
Primary targets: Iranian dissidents, opposition journalists, human rights activists, and members of the Iranian diaspora — particularly those active on Telegram, WhatsApp, and Instagram.
Secondary targets: Any individual or organization in the trust network of a primary target, since cloned Telegram sessions enable impersonation-based lateral targeting.
Organizational risk: NGOs, media organizations, and advocacy groups employing individuals who may be primary targets. A compromised personal device can become a beachhead into organizational communications.

Detection Considerations

Defenders should monitor for: unauthorized modifications to Defender exclusion paths (Event ID 5004, or via Get-MpPreference auditing); new autorun registry entries referencing recently-created executables; outbound network connections from Delphi-compiled binaries with GUI windows but no signed publisher; and unexpected Telegram session file access or copy operations originating from non-standard process trees. The UK NCSC tracks the malware family as CHOSEN BRICK, which provides an additional indicator namespace for threat intelligence correlation.

Shield53 Recommendations

  • Audit Defender exclusions: Schedule weekly checks of Add-MpPreference -ExclusionPath entries across all endpoints. Alert on any unauthorized additions, especially those pointing to user-writable directories like %APPDATA% or %TEMP%.
  • Application control: Enforce AppLocker or WDAC policies that block execution of unsigned Delphi binaries from user-writable locations. CRUDEEXCLUDE relies on the ability to execute from non-standard paths.
  • Telegram session monitoring: For high-risk users, monitor for unauthorized device sessions via Telegram's active sessions feature. Enable two-step verification and session password on all Telegram accounts.
  • Social engineering awareness: Brief at-risk personnel that the primary delivery vector is trusted-contact impersonation on messaging platforms offering unsolicited technical support or software updates. Verify any software download through secondary channels before execution.
  • Registry persistence hunting: Include autorun key monitoring in your baseline EDR detection rules. HEAVYGRAM persists via HKCU\Software\Microsoft\Windows\CurrentVersion\Run — a well-known but still effective persistence location that automated threat hunting should continuously sweep.