Backdoor Telegram Bot API C2 polling (api.telegram.org SNI)

Duo Tech@duotech

•updated Jul 2, 2026•0•0•2

Detects frequent, persistent outbound TLS connections to api.telegram.org. This behavior is indicative of a malware sample or backdoor polling the Telegram Bot API for command and control (C2) instructions, effectively using the legitimate Telegram infrastructure to tunnel malicious communication.