Montana Empire - Telegram C2 Credential Exfiltration

Georg Lauenstein@gsec

•updated Jul 1, 2026•1•0•8

Detects network connections to Telegram bot API endpoints consistent with the Montana Empire phishing kit's credential exfiltration mechanism. This kit uses Telegram as a C2 channel for real-time data theft from phantom squatting domains that exploit AI-hallucinated URLs.