Non-Browser Process Querying Telegram API

Bhojraj Joshi@cybrbhojrajjoshi

•updated May 28, 2026•24•4•206

Detects non-browser processes making DNS queries to the Telegram Bot API. This activity is indicative of malware using Telegram for Command and Control (C2) communications or data exfiltration, such as Amnesia RAT.