Skip to content
Threat Feed
Subscribe

Product

Telegram Bot API

1 brief RSS
high advisory

Windows DNS Query to Telegram Bot API Indicating Malware C2

This brief details the detection of suspicious DNS queries from non-Telegram processes to api.telegram.org on Windows systems, a strong indicator of malware utilizing the Telegram Bot API for command and control (C2) communications to receive commands or exfiltrate data.

Telegram Bot API network command-and-control c2 telegram windows malware
1r 2t 1i