Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware

HEAVYGRAM is a Windows surveillance backdoor that turns Telegram into an operational command center for attackers. Rather than relying on a dedicated server, it uses bots, accounts and groups to receive instructions, move stolen data and keep infected devices under control.

The malware has been used since fall 2023 against journalists, Iranian dissidents and people whose views oppose Iran’s government.

Victims were approached through messaging apps by people posing as familiar contacts or technical support, then sent files disguised as applications or services.

The campaign also relies on persuasive, context-specific decoys. Researchers at Group-IB identified 29 additional HEAVYGRAM samples, loaders and payloads while tracing this activity.

Their findings expand on U.S. government disclosures and link the operation to Handala Hack with moderate confidence, showing a surveillance effort built around social engineering and long-term access.

The impact reaches beyond a single infected computer. HEAVYGRAM can collect screenshots and audio, capture cached information, steal Telegram desktop data, run commands, add new payloads and delete files.

Group-IB said in a report shared with Cyber Security News (CSN) that the combination creates a risk for sources, private communications and sensitive work held by targeted people.

HEAVYGRAM Surveillance Malware

HEAVYGRAM’s operators use Telegram’s bot API to make an infected Windows machine check in, accept commands and send results back.

One configuration relies on a single bot while another uses two bots for check-ins, logging and delivery of later stages. The model can make malicious traffic look like routine web activity, a problem also seen in Telegram bot malware control campaigns.

After installation, the implant records the computer name and sends an initial beacon. It then sends a health message every 24 hours, letting operators see whether the device remains active.

Commands can start programs, collect system details, take screenshots, run secondary malware and exfiltrate Telegram Desktop files.

The attack begins with a convincing lure. First-stage files have posed as Pictory, KeePass and Telegram-related programs, with names chosen to look legitimate.

Some delivery chains use scripts or HTML applications, while others unpack embedded archives. This use of trusted-looking software mirrors trojanized messaging app installers used in other Windows attacks.

The implant also uses Windows registry entries to survive restarts. Associated CRUDEEXCLUDE samples may add security-exclusion paths before releasing HEAVYGRAM, giving the attackers another way to reduce the chance of detection.

Targeted Surveillance and Defense

The research connects HEAVYGRAM to a campaign aimed at people of interest to Iran, including a journalist at a UK-based Farsi-language news outlet and a U.S.-based victim described in public records.

The reported Handala link also fits the group’s wider history of coercive activity, including MOIS-linked destructive intrusions that have affected organizations in several countries.

A victim may see a decoy document or video while the malware retrieves a later stage and establishes persistence. Operators can later fetch attachments through Telegram, execute them on the host and use DLL side-loading, where a legitimate program loads a harmful companion file.

People at risk should install software only from official vendor sources and verify unexpected contacts through a separate trusted channel.

They should limit messaging-app privacy settings, treat unrequested files cautiously, and apply operating-system and security updates promptly. These steps are especially important when a message appears to come from a colleague or support team.

Organizations should isolate systems that match the indicators, review Windows autorun registry keys and review outbound bot API connections for Telegram backdoor delivery tactics.

Teams should identify unusual native-process launches, system folders with trailing spaces and unauthorized access to messaging data directories.

Application control can block binaries launched from APPDATA, ProgramData and other user-writable locations. Where Telegram is not an approved business tool, monitoring or blocking its API traffic can reduce exposure.

Code-signing checks and staff awareness training add useful layers, while threat teams should feed the indicators below into detection and response workflows.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Hackers Turn Telegram Into a Command Center for HEAVYGRAM Surveillance Malware appeared first on Cyber Security News.