Actor Profile

Handala Hack is an Iran-linked hacktivist persona attributed to VOID MANTICORE (also tracked as COBALT MYSTIQUE, Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS). The persona emerged shortly after the October 7, 2023 Hamas attacks on southern Israel. VOID MANTICORE has a history of conducting destructive wiping attacks and hack-and-leak operations targeting Iranian dissidents, journalists opposed to Iran, and other opposition groups to conduct intelligence collection, leak data, and inflict reputational harm. The FBI has attributed these activities to Iranian cyber actors acting on behalf of MOIS.

TTPs (Tactics, Techniques, Procedures)

The actor employs social engineering via Telegram, WhatsApp, and Instagram to deliver malware disguised as legitimate applications (T1566). HEAVYGRAM, a Python-based backdoor first detected in September 2023, uses Telegram for C2 (T1102) and supports remote command execution via PowerShell (T1059.001) and WMI (T1047), screenshot capture (T1113), audio recording (T1123), data exfiltration (T1119), Telegram/WhatsApp session theft (T1657), password theft (T1110.001), and persistence via Windows autorun registry keys. CRUDEEXCLUDE, a Delphi-based utility, configures Microsoft Defender exclusion paths (T1564.003) and prepares environments for subsequent stage deployment. The actor also employs Group Policy modification (T1484.001), domain/DNS acquisition (T1583.001), and has conducted disk wiping (T1561.001) and ransomware operations (T1486) in previous campaigns.

Targets & Patterns

The actor primarily targets Iranian dissidents, journalists opposed to the Iranian regime, and other opposition groups. In September 2024, the Canadian RRM documented the targeting and doxxing of five Iran International journalists, including one from Iran, as part of a hack-and-leak operation. The targeting pattern reflects MOIS intelligence collection priorities focused on monitoring and suppressing opposition voices, conducting surveillance on regime critics, and inflicting reputational harm through data leaks. The use of social engineering via popular messaging platforms suggests the actor seeks to exploit trust relationships and technical support scenarios to gain initial access to high-value individuals.

Historical Context

HEAVYGRAM was first detected in the wild in September 2023, shortly after the Handala Hack persona emerged following the October 7, 2023 attacks. CRUDEEXCLUDE was first observed in late July 2024 and documented by Google in December 2025. The FBI issued alerts about this activity in March 2026 and again in September 2026. The U.K. NCSC tracks the same malware family as CHOSEN BRICK. VOID MANTICORE has a documented history of destructive operations and hack-and-leak campaigns, with the September 2024 targeting of Iran International journalists representing a continuation of their operational pattern against regime critics and opposition media.

Defensive Recommendations

  • Monitor for Microsoft Defender exclusion path modifications (T1564.003) via registry changes or PowerShell commands, particularly in non-administrative contexts
  • Detect PowerShell-based persistence mechanisms (T1059.001) by monitoring Windows Registry autorun keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run) for suspicious entries
  • Implement network monitoring for Telegram API traffic (api.telegram.org) from non-browser processes and correlate with process execution anomalies to detect C2 activity (T1102)
  • Alert on access to Telegram Desktop and WhatsApp session files (T1657) from unexpected processes, particularly Python interpreters or unsigned executables
  • Conduct user awareness training on social engineering tactics involving technical support impersonation via messaging platforms, emphasizing verification of contact authenticity before downloading files

---

# Geopolitical Context

Geopolitical Context

The Handala Hack persona, assessed to be operated by Void Manticore (also tracked as Banished Kitten, Red Sandstorm, and Storm-0842), is attributed to Iran's Ministry of Intelligence and Security (MOIS). The persona emerged following the October 7, 2023 Hamas attacks on Israel, reflecting Tehran's use of cyber operations to advance intelligence collection and influence objectives in the context of regional tensions. The FBI has formally accused Iranian cyber actors of targeting dissidents, journalists, and opposition groups—consistent with Iran's documented pattern of transnational repression. The campaign demonstrates Iran's continued investment in surveillance capabilities that leverage commercial platforms for command-and-control, reducing operational costs and detection risk while enabling persistent access to targets of strategic interest to the regime.

State Actor Alignment

HEAVYGRAM and CRUDEEXCLUDE are attributed to Handala Hack, an online persona linked to Void Manticore, a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS). The U.S. Federal Bureau of Investigation issued alerts in March 2026 and September 2026 formally accusing Iranian cyber actors acting on behalf of MOIS of conducting these operations. The U.K. National Cyber Security Centre tracks the same malware family as CHOSEN BRICK. Canada's Rapid Response Mechanism previously identified Handala Hack targeting Iran International journalists in hack-and-leak operations. The actor has a documented history of destructive wiping attacks and doxxing campaigns, consistent with state-directed objectives of intelligence collection, reputational harm, and transnational repression of Iranian dissidents and opposition voices.

Business Impacty pro region

The campaign primarily targets Iranian dissidents, journalists, and opposition groups globally, with documented cases involving Iran International journalists including at least one from Canada. The use of social engineering via widely adopted platforms—Telegram, WhatsApp, and Instagram—indicates a transnational operational scope that extends beyond Iran's borders, affecting diaspora communities in Europe, North America, and the Middle East. The FBI and U.K. NCSC public advisories signal Western concern over Iran's expanding cyber surveillance capabilities and willingness to conduct extraterritorial operations against perceived threats to the regime. European states hosting Iranian opposition figures and media outlets may face increased pressure to enhance protective security measures for at-risk individuals. The reliance on Telegram for C2 infrastructure also highlights challenges for platform governance and the dual-use nature of encrypted communications in authoritarian surveillance contexts.

Forecast

If Iranian regional tensions remain elevated—particularly regarding nuclear negotiations, proxy conflicts, or domestic unrest—MOIS-affiliated actors are likely to sustain surveillance and hack-and-leak operations targeting dissidents and opposition media. The low-cost, flexible nature of Telegram-based C2 infrastructure suggests HEAVYGRAM or similar tooling may proliferate across additional MOIS-linked groups. If Western governments impose additional sanctions or cyber-focused designations on MOIS entities, operational tempo may temporarily decrease, though infrastructure rotation costs remain minimal. Continued public advisories from the FBI and allied agencies may prompt increased platform scrutiny of abuse, potentially forcing tactical shifts toward alternative C2 channels. Organizations and individuals assessed to be of interest to Iranian intelligence services should anticipate sustained social engineering attempts via messaging platforms, particularly those involving technical support pretexts or trusted contact impersonation.