Vidar - Telegram Description C2 Retrieval (T1102.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Identifies network connections to Telegram domains used by Vidar to read the C2 IP address dynamically from the profile description, specifically when initiated by AutoIt3.exe.