BQTLock Telegram Bot API C2 and Exfiltration via Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.