Topic

Messaging-app command and control

The technique of running malware control channels and data exfiltration through consumer messaging platforms and their bot APIs so the traffic resembles ordinary app use.

Current clusters

security1 publisher

Iran's HEAVYGRAM spyware assigns each infected Windows PC its own Telegram bot

The September 15 advisory from the NCSC, the FBI and the AIVD lists a registry Run key, a folder path with a stray space and traffic to api.telegram.org as the practical detection points for at-risk staff.

Publishers:thehackernews.com

Reality

Evidence70
Adoption45
Hype gap0
Incentives60
Confidence62