HEAVYGRAM Telegram-based Surveillance Backdoor
HEAVYGRAM is a Windows-based surveillance backdoor used by Handala Hack that utilizes the Telegram API for command-and-control communication to facilitate remote information theft and system monitoring.
HEAVYGRAM is a Windows-based surveillance backdoor recently identified as a key component in campaigns attributed to the threat actor Handala Hack. The malware functions as a covert surveillance tool, designed to exfiltrate sensitive user and system information from compromised Windows environments. A primary feature of HEAVYGRAM is its use of the Telegram Bot API as a command-and-control (C2) channel, which allows attackers to blend malicious traffic with legitimate network requests to Telegram's infrastructure. By leveraging a widely used messaging platform for exfiltration, the actor complicates traditional network-based detection. The backdoor is capable of remote surveillance, data harvesting, and general-purpose system control, posing a significant risk to organizations targeted by Handala Hack. Defenders should focus on monitoring anomalous outbound traffic to the Telegram API domain and identifying unauthorized processes executing surveillance-related operations on Windows endpoints.
Impact
The use of HEAVYGRAM enables Handala Hack to maintain persistent, covert access to victim systems. Impact includes the theft of sensitive data, unauthorized remote surveillance of users, and potential further compromise of internal networks. The deployment of this backdoor targets organizations specifically chosen by the actor for intelligence gathering and disruption, with the primary damage being the loss of data confidentiality and integrity.
Recommendation
Detection engineering teams should prioritize identifying network traffic patterns consistent with Telegram API communication originating from non-standard processes.
- Deploy network monitoring to identify excessive or unusual HTTPS traffic to 'api.telegram.org' from unauthorized binaries.
- Implement process-creation logging to identify instances where the HEAVYGRAM executable initiates reconnaissance or data collection commands.
- Audit outbound traffic logs for persistent connections to the Telegram API by processes that are not recognized enterprise messaging clients.
Immediate actions
Review outbound network logs for traffic to api.telegram.org generated by non-standard browser or enterprise communication processes.
Threat Hunt
Identify long-running processes initiating network connections to Telegram API endpoints.
Data: Network connection logs (DestinationDomain, ProcessName, User)
Mitigations
Restrict outbound access to known C2 infrastructure or apply strict application allowlisting for processes authorized to access external messaging APIs.
Command and Control