Millenium RAT Telegram Bot API C2 from Suspicious Process Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes executing from potentially suspicious or non-standard locations (Temp, AppData, ProgramData), excluding the legitimate Telegram Desktop client. This pattern is commonly observed in Remote Access Trojans (RATs) such as the Millenium RAT and other malware families utilizing Telegram as a C2 channel.