Two new reports from The Hacker News describe Iranian cyber operations built around a Windows backdoor that uses Telegram as its command channel. The first links the Handala Hack persona to a backdoor called HEAVYGRAM, which supports remote command execution and system and network operations, alongside a Delphi-based utility named CRUDEEXCLUDE. The second, drawing on alerts from US, UK, and Dutch cybersecurity agencies, says Iran's intelligence service uses a similar Telegram-controlled malware to spy on dissidents, journalists, and activists worldwide.
The two accounts largely agree on the technical mechanism: Telegram serves as the control plane for the malware, giving operators a low-cost, hard-to-block way to issue commands. Both sources also connect the malware to Iranian operations, though they differ on attribution. The first report frames Handala Hack as an Iran-linked "hacktivist" persona, while the second attributes the activity directly to Iran's intelligence service. That distinction matters for threat models, but the underlying tooling appears consistent.
The reports do not provide full technical details, such as infection vectors or Telegram bot identifiers. They do make clear that the backdoor is capable of stealing passwords and executing remote commands, making it a serious surveillance tool. For journalists and activists, the takeaway is that a public messaging platform is now being used as a covert espionage channel.