Montana Empire C2 - Outbound Telegram Bot API Exfiltration from Web Server

Duo Tech@duotech

•updated Jul 1, 2026•0•0•0

Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.