> TritonInfoSec News
Home / Sep 18, 2026 / Story
0
#10 The Hacker News general September 17, 2026 at 14:03 UTC

Iran-Linked Handala Hack Tied to HEAVYGRAM Telegram Backdoor That Can Steal Passwords

By [email protected] (The Hacker News)

AI Summary

Iran-linked hacktivist persona Handala Hack has been attributed to HEAVYGRAM, a Telegram-based surveillance backdoor built with capabilities including remote command execution, credential and session file exfiltration, screenshot capture, DLL sideloading, and Telegram session hijacking, alongside a Delphi-based utility called CRUDEEXCLUDE. The attribution links a politically motivated persona to sophisticated persistent access tooling, raising the operational threat level of what had appeared to be a hacktivist group.

Read full article → https://thehackernews.com/2026/09/iran-linked-hand…

Relevance score: 75.0/100

# More from September 18

  1. 1
    Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks The Hacker News
  2. 2
    Cisco alerts customers to second actively exploited zero-day in as many days CyberScoop
  3. 3
    Brevo supply-chain attack injected ClickFix scripts on customer sites BleepingComputer
  4. 4
    Cyberattacks on Two Oil Tankers Prompt Coast Guard, FBI to Board Vessels SecurityWeek
  5. 5
    Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root The Hacker News
  6. 6
    China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America The Hacker News
  7. 7
    Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records The Hacker News
  8. 8
    Revolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M Ransom SecurityWeek
  9. 9
    BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS The Hacker News