HEAVYGRAM PowerShell Telegram sendMessage check-in beacon

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•2

Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.