Network Connection to Telegram API

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•4

Detects network connections to the Telegram API, specifically to the /sendMessage or /getUpdates endpoints. This activity can be indicative of command and control (C2) communication or data exfiltration using Telegram as a covert channel.