Millenium RAT C2 via Telegram Bot API getUpdates Polling from Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.