Group-IB Uncovers HEAVYGRAM Multi-Stage Windows Spyware Controlled via Telegram Bot API
Researchers at Group-IB have discovered 29 new samples of HEAVYGRAM, a multi-stage Windows spyware that targets journalists, Iranian dissidents, and critics of the authorities. Operators control infected systems through Telegram bots, making the messaging platform function as a command-and-control channel.
The attack begins with classic social engineering. Attackers pose as acquaintances or technical support and send archives that appear to contain Telegram, KeePass, or a video editor. Additional lures include WSF and HTA scripts, fake presentations, and a Persian-language screensaver listing expelled students.
After execution, the malware downloads further components via PowerShell, registers itself for persistence in Windows startup, and adds its directories to Microsoft Defender exclusions. The main implant is written in Python, packaged with PyInstaller, and can employ DLL side-loading for stealthy execution.
HEAVYGRAM’s primary feature is its use of the Telegram Bot API. Through bots the malware accepts commands, executes arbitrary instructions, takes screenshots, lists running processes, and sends stolen data back to operators. It also steals session files from Telegram Desktop, allowing account takeover without requiring the victim’s password again.
Group-IB links the campaign to the Handala Hack group and its internet persona Void Manticore, also known as Storm-0842 and Red Sandstorm, which is assessed to act in the interests of Iranian intelligence. Defenders are advised to monitor PowerShell commands that modify Microsoft Defender exclusions, restrict unverified scripts, and inspect suspicious calls to the Telegram Bot API.
Related articles
Reflective DLL Injection: How Malware Executes DLLs Directly in Memory Without Disk Files
Reflective DLL Injection allows malicious code to load and execute a DLL entirely in memory, bypassing traditional file-based loading mechanisms on Windows. The technique uses a custom loader inside the DLL itself to handle PE format parsing, relocations, imports, TLS, and exception handling without calling LoadLibrary. Unlike standard loading, the resulting module often resides in MEM_PRIVATE regions and does not appear in conventional module lists, complicating forensic analysis. Tools such as Meterpreter and Cobalt Strike have historically employed reflective loaders, though Beacon Object Files represent a different COFF-based approach. Investigators must examine memory regions, thread start addresses, and Sysmon events 7, 8, and 10 rather than relying solely on file artifacts. The method does not bypass DEP, Arbitrary Code Guard, or access-control restrictions and leaves detectable traces when combined with behavioral indicators. Proper detection requires correlating private executable memory with process behavior and avoiding over-reliance on simplified signatures.
Leaked DarkSword iOS Exploit Chain 'P7' Now Steals Crypto Wallet Seeds and Keystores
A third build of the P7 variant of the leaked DarkSword iOS exploit chain has been identified, featuring a new lure site themed around Chinese online casinos and a fresh command server. The chain exploits six vulnerabilities, including three zero-days, to deploy an implant that decrypts the keychain directly on the device and extracts seed phrases from wallets such as imToken, Trust Wallet, and Phantom. Unlike the original GHOSTBLADE, P7 rewrites the C2 agent to focus exclusively on wallet data while retaining the core TaskRop and MIG-filter bypass modules. Passive analysis of public sources also uncovered the long-running 'qqtime' delivery cluster that pairs DarkSword with the older Coruna chain for broader iOS coverage. The operator uses channel codes to support multiple affiliate distributors and employs an AppleKeyStore oracle to decrypt keychain items locally before exfiltration.
Censys Exposes DarkSword iOS Exploit Platform and Coruna Crypto Wallet Stealer
Censys has disclosed the inner workings of DarkSword, a commercial platform that sells remote access to iOS devices, along with its associated malware Coruna that targets cryptocurrency wallet recovery keys. The infrastructure was exposed between September 15 and 17, allowing researchers to analyze the full attack chain starting from a WebKit and JavaScriptCore exploit delivered through the browser. After escaping the Safari sandbox and reaching the kernel, the platform deploys three layers including a flag, controller, and main implant. Coruna then scans the device for BIP39-compliant seed phrases stored in photos and Apple Notes across 19 targeted wallet applications such as MetaMask, Phantom, Trust Wallet, Coinbase, Exodus, imToken, Bitpie, and BitKeep. The exposed server contained 11 victim recovery keys, 179 directories of extracted data, and 75 operator accounts, indicating a structured commercial operation with agent accounts, commissions, and device quotas. Confirmed infections affect devices running iOS 16.1 and 16.3.1, while Apple has extended patches to additional iOS 18 devices. Maintaining updated iOS versions remains the primary defense against this threat.
How Malware Evades Sandboxes: Detection Techniques and Defense Strategies
Sandboxes have become a standard tool for analyzing suspicious files delivered via email, websites, messengers, and cloud storage. Modern malware often avoids detection by identifying virtual environments rather than directly attacking the sandbox. Techniques include checking for virtualization artifacts, system parameters, hardware signatures, network indicators, user activity, and timing delays. Reports such as Picus Red Report 2026 show technique T1497 returning to the top five most common MITRE ATT&CK methods. Examples like Blitz, GootLoader, and LummaC2 demonstrate environment checks and behavioral evasion. Effective defense requires combining multiple analysis methods, realistic sandbox profiles, pre-delivery inspection, and integration with other security controls.