🔴 Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM

A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation.

The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people perceived as opponents of the Iranian government.

The research expands on U.S. government disclosures issued earlier this year.

On March 19, the U.S. Department of Justice seized four domains it said were used by Iran’s Ministry of Intelligence and Security (MOIS) to support cyber-enabled psychological operations and transnational repression, including Handala-Hack[.]to and Handala-Redwanted[.]to.