Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM
Thu Sep 17 2026
APT
Attack
BRAND:Microsoft
Endpoint
Malware
Threat Intel
gbhackers.com
A previously undocumented HEAVYGRAM and CRUDEEXCLUDE malware samples linked with moderate confidence to the Iran-aligned Handala Hack operation. The campaign combines targeted social engineering, Microsoft Defender exclusion abuse, multi-stage loaders, and Telegram-based command-and-control to surveil Iranian dissidents, journalists, and people perceived as opponents of the Iranian government. The research expands on U.S. government disclosures issued […]
The post Handala Hack Uses CRUDEEXCLUDE to Disable Defender Protections and Deploy HEAVYGRAM appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.