A Windows surveillance campaign is using Telegram as both a command channel and a route for moving stolen data. The malware, known as HEAVYGRAM, has been deployed since at least late 2023 against journalists, Iranian dissidents and other people whose work or views may interest Iran’s government.

Group-IB researchers identified 29 additional samples, loaders and payloads connected to the activity. Their analysis links the operation to Handala Hack with moderate confidence and builds on earlier U.S. government disclosures. The evidence describes a patient espionage workflow that combines tailored social engineering, persistent endpoint access and infrastructure hidden behind a widely used messaging platform.

Telegram becomes the attackers’ control plane

Instead of maintaining a conventional command-and-control server, HEAVYGRAM communicates through Telegram bots, accounts and groups. One configuration uses a single bot, while another divides check-ins, logging and payload delivery between two bots. The infected computer sends an initial message containing its name and follows with a health beacon every 24 hours.

Operators can issue commands, collect system details, take screenshots, capture audio, run programs, retrieve additional malware and remove files. The backdoor can also steal Telegram Desktop data and cached information, putting private discussions, contacts and sources at risk. Attachments delivered through Telegram may be fetched and executed on demand.

Using a legitimate cloud service gives attackers operational advantages. Traffic to Telegram’s bot API can blend with normal encrypted web activity, and defenders may hesitate to block a service used by employees. The approach also reduces the need for bespoke hosting, though bot identifiers, unusual API patterns and access from unauthorized systems can still create detection opportunities.

Trust and convincing lures open the door

The intrusion begins with direct contact through messaging applications. Attackers have posed as known contacts or technical-support personnel and sent files presented as useful applications or services. First-stage files have imitated software such as Pictory, KeePass and Telegram-related tools, using familiar names to lower suspicion.

Some delivery chains rely on scripts or HTML applications; others unpack embedded archives. A victim may see a decoy document or video while a later stage is installed in the background. Associated CRUDEEXCLUDE components can add security-exclusion paths before deploying HEAVYGRAM, and DLL side-loading allows a legitimate program to load a malicious companion library.

Persistence is established through Windows registry entries so that the implant returns after restart. The combination of personal pretexts and multiple technical pathways makes the campaign particularly dangerous for individuals who routinely receive unsolicited documents, interview requests or requests for secure communication.

Who is being targeted

The reporting identifies victims connected to Iran, including a journalist at a United Kingdom-based Farsi-language media outlet and a U.S.-based individual referenced in public records. For these targets, compromise can have consequences beyond ordinary credential theft. Colleagues, confidential sources, location clues and unpublished material may all become exposed.

The suspected Handala connection also places the malware within a broader pattern of coercive and disruptive operations associated with Iran’s Ministry of Intelligence and Security. Attribution remains an analytical judgment rather than proof of who typed each command, but the victimology, tooling and surrounding activity give defenders useful context.

Defending against a socially engineered implant

• Verify unexpected contacts through a separate, trusted channel before opening files.
• Install messaging, password-management and media tools only from official vendor sources.
• Review autorun registry keys and application-control events on potentially exposed Windows hosts.
• Hunt for unusual access to Telegram Desktop data and outbound Telegram bot API connections.
• Block unapproved executables from AppData, ProgramData and other user-writable directories.

Security teams should also investigate suspicious child processes from trusted-looking applications and folders whose names include deceptive spacing. If Telegram is not approved for business use, restricting its API can reduce exposure. Where it is allowed, proxy and endpoint telemetry should be combined because a network destination alone will not distinguish a legitimate user from a backdoor.

Potential victims should be treated with care: isolating the device, preserving evidence and rotating credentials from a known-clean system are safer than confronting an attacker through the compromised channel. HEAVYGRAM shows why targeted surveillance cannot be solved by signatures alone. Strong identity verification, controlled software execution and behavior-based monitoring are all needed to interrupt the attack chain.