LARP53RAT C2/Exfil via Telegram Bot API from Suspicious Process Path

Subhankar H@Andrewsec57

•updated Jul 3, 2026•4•0•12

Detects network communication with the Telegram API (api.telegram.org) originating from processes located in suspicious, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of potential command and control (C2) communication or data exfiltration via the Telegram Bot API by malware.