HEAVYGRAM Telegram Bot C2 Prefix-Delimited Command Parsing

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.