Telegram Bot API abused as C2 channel for beacon action codes

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•0

This rule detects HTTP POST requests to the Telegram Bot API where the request body contains specific action keywords (e.g., VIEW or MOBILE). This pattern is often indicative of C2 communication using legitimate Telegram infrastructure to control compromised systems.