Office Apps Contacting Telegram API_MuddyWater Operation Olalampo Campaign

Kaung Khant Ko@kaungkhantko

•updated Feb 23, 2026•14•0•122

Detects network connections from Microsoft Office applications to the Telegram API. This behavior is a strong indicator of compromise, as threat actors like MuddyWater (in campaigns such as Operation Olalampo) use Telegram bots for command-and-control (C2) initiated by malicious macros in documents.