Top Tweets for #CrudeExclude

5 days ago

#ThreatProtection #HeavyGram and #CrudeExclude #malware distribution, read more about Symantec's protection: https://t.co/pzyi4pJqOE

Group-IB Global

@GroupIB

6 days ago

A familiar messaging platform can become much more than a communication tool when threat actors turn it into part of their attack infrastructure. Group-IB #ThreatIntelligence uncovered 29 new samples associated with the #HEAVYGRAM and #CRUDEEXCLUDE malware families, providing new insight into activity attributed with moderate confidence to #HandalaHack. Key Highlights: 🔹 HEAVYGRAM is a Windows backdoor capable of remote command execution, screenshot capture, system and process discovery, Telegram session data exfiltration and persistence through Windows autorun registry keys. 🔹 Telegram-based C2 is central to the operation. HEAVYGRAM uses Telegram bots, users and groups to receive commands, exchange files and exfiltrate data. 🔹 Application masquerading is used to deceive victims, with samples posing as legitimate applications including Telegram, KeePass and Pictory. 🔹 CRUDEEXCLUDE supports defense evasion by adding paths to Microsoft Defender exclusions before deploying additional stages. 🔹 Multiple delivery mechanisms were identified, including WSF, VBS, HTA and executables containing embedded archives. 🔹 Much of the identified #Telegram infrastructure continues to remain present on Telegram as of 2026, rather than deleted, although some of the identified accounts have since been taken over by unrelated actors and repurposed for other activity. Read the full technical analysis to understand the infection chain, malware capabilities, infrastructure and defensive recommendations: https://t.co/hCZbqJrBU4

GroupIB's tweet photo. A familiar messaging platform can become much more than a communication tool when threat actors turn it into part of their attack infrastructure.

Group-IB #ThreatIntelligence uncovered 29 new samples associated with the #HEAVYGRAM and #CRUDEEXCLUDE malware families, providing new insight into activity attributed with moderate confidence to #HandalaHack.

Key Highlights:
🔹 HEAVYGRAM is a Windows backdoor capable of remote command execution, screenshot capture, system and process discovery, Telegram session data exfiltration and persistence through Windows autorun registry keys.
🔹 Telegram-based C2 is central to the operation. HEAVYGRAM uses Telegram bots, users and groups to receive commands, exchange files and exfiltrate data.
🔹 Application masquerading is used to deceive victims, with samples posing as legitimate applications including Telegram, KeePass and Pictory.
🔹 CRUDEEXCLUDE supports defense evasion by adding paths to Microsoft Defender exclusions before deploying additional stages.
🔹 Multiple delivery mechanisms were identified, including WSF, VBS, HTA and executables containing embedded archives.
🔹 Much of the identified #Telegram infrastructure continues to remain present on Telegram as of 2026, rather than deleted, although some of the identified accounts have since been taken over by unrelated actors and repurposed for other activity.

Read the full technical analysis to understand the infection chain, malware capabilities, infrastructure and defensive recommendations: https://t.co/hCZbqJrBU4

646

Group-IB Threat Intelligence

@GroupIB_TI

6 days ago

Group-IB #ThreatIntelligence uncovered 29 new samples associated with #HEAVYGRAM and #CRUDEEXCLUDE, expanding the technical picture of a multi-stage intrusion chain attributed with moderate confidence to #HandalaHack. The malware has been used since 2023 and targets include Iranian dissidents, journalists and others viewed as opposing the Iranian government.

Top Tweets for #CrudeExclude

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users