Sauron Ransomware Telegram Bot API C2 and Exfiltration Traffic

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.