Millenium RAT C2 via Telegram Bot API getUpdates Polling

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.