CHOSEN BRICK Telegram Bot API C2 Beacon (api.telegram.org)

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•0

Detects network traffic directed to the Telegram Bot API (api.telegram.org) characterized by TLS SNI indicators or specific HTTP URI structures (e.g., /bot). This behavior is indicative of malware or automated tools using the Telegram platform as a command-and-control (C2) channel for beaconing, command delivery, or data exfiltration.