> Concept · telegram-bot-exfiltration — Using the Telegram Bot API as a malware C2 channel_

~/packetpursuit $ cat /intel/concepts/telegram-bot-exfiltration.md

typeconceptconfidencehighcreated2026-06-09updated2026-06-09c2-protocolexfiltrationmalware-familyc2

telegram-bot-exfiltration

Definition

The Telegram Bot API (https://api.telegram.org/bot<TOKEN>) is used as a C2 and exfiltration channel: malware POSTs victim data (clipboard contents, screenshots, geolocation, system fingerprint) to a sendMessage endpoint with a hardcoded chat_id. The attacker reads replies and commands via getUpdates from any Telegram client. No dedicated infrastructure required; bot token creation is near-frictionless.

Variants

Variant Mechanism Families Observed
Static token Bot token hardcoded in binary strings unclassified-pe32-clipper, maskgramstealer (embedded)
Runtime token Token fetched from secondary C2 or decrypted at runtime dolphin, zenconnekt
Chat-ID hardcoded chat_id embedded; token may be injected by builder unclassified-pe32-clipper
Group chat / channel Exfil posts to a private group or channel, not DM dolphin (reported in open sources)
Inline keyboards Command dispatch via CallbackQuery instead of plain text (not observed in this corpus yet)

Detection Fingerprint

  • Domain: api.telegram.org (rare on enterprise PCs)
  • URI path: /bot followed by a 9-10 digit numeric token
  • Parameters: chat_id, text, parse_mode=Markdown / HTML
  • User-Agent varies by client library (curl, WinHTTP, Go net/http)

Defensive Notes

  • DNS / proxy block api.telegram.org unless business need.
  • Alert on processes (not browsers) making HTTPS to api.telegram.org.
  • Telegram bot tokens are 9-10 digit numerics + alphanumeric suffix — regexable in proxy logs.

Related