Non-browser HTTP/TLS connection to Telegram shortened URL (Vidar dead-drop resol

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•1

Detects outbound network traffic from internal hosts to Telegram shortened URLs (t.me). The detection looks for TLS SNI strings or HTTP requests targeting t.me domains, specifically focusing on non-browser user-agent strings which are indicative of Vidar-style malware using Telegram as a dead-drop resolver for C2 operations.