Windows DNS Query Request by Telegram Bot API

This brief highlights a detection for malicious activity where processes other than the legitimate Telegram application make DNS queries to api.telegram.org. This behavior is a strong indicator of malware leveraging the Telegram Bot API for command and control (C2) communications or data exfiltration on compromised Windows systems. Threat actors frequently exploit popular, legitimate communication platforms like Telegram to blend malicious traffic with normal network activity, making detection challenging. This specific analytic focuses on identifying suspicious DNS lookups to Telegram's API domain by unauthorized processes, signaling a potential covert communication channel established by malware. Attackers utilize these channels to issue commands, download additional payloads, or exfiltrate sensitive data from the victim's network, representing a post-exploitation phase in a broader cyberattack.

Attack Chain

1. Initial Access: (Not detailed in source, but implied by malware presence.) An attacker gains initial access to a Windows system through various means (e.g., phishing, exploit, compromised credentials).
2. Execution: Malware is executed on the compromised system.
3. Command and Control (C2) Setup: The malware attempts to establish communication with its C2 server.
4. DNS Query for C2: The malware process performs a DNS query for api.telegram.org to resolve the Telegram Bot API endpoint.
5. Covert Communication: The malware utilizes the Telegram Bot API as a C2 channel to receive commands or exfiltrate data, bypassing traditional network controls by leveraging a legitimate service.
6. Impact: Depending on commands received, the malware can lead to data theft, further system compromise, or ransomware deployment.

Impact

Successful exploitation where malware utilizes the Telegram Bot API for C2 or data exfiltration can lead to severe consequences. Attackers can maintain persistent access to the compromised system, exfiltrate sensitive company data, deploy additional malicious payloads such as ransomware or other destructive tools, or pivot to other systems within the network. This covert communication method significantly increases the difficulty of detecting and containing breaches, potentially leading to financial losses, reputational damage, and regulatory penalties. The specific number of victims or sectors is not detailed, but such C2 methods are common across various industries.

Recommendation

• Enable Sysmon Event ID 22 for DNS query logging on all Windows endpoints to gather the necessary telemetry for detection.
• Deploy the Sigma rule provided in this brief to your SIEM and tune for your environment to detect suspicious DNS queries.
• Monitor network connections and DNS queries to the api.telegram.org domain, especially from processes other than legitimate Telegram clients.