CHOSEN BRICK implant beacons to Telegram C2 then uploads to cloud storage (audio

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•4

Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.