Messaging platforms as command and control

CHOSEN BRICK routes its commands through a Telegram bot issued per victim device

A joint NCSC, FBI and AIVD advisory traces the implant's exfiltration to Telegram and three object storage hosts. The same advisory tells defenders not to read traffic to those services as malicious on its own.