Non-Browser Process Querying Telegram API

Tim Peck@timpeck

•updated Jan 20, 2026•5•0•101

Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.