Malware News The Close Relationship Between Telegram Bots and Threat Actors: New Stealers, Hunters Becoming the Hunted.

[Khushal]

Content source

https://cti.monster/blog/2026/03/24/new-stealers.html

Introduction​

AI has made it stupid easy to spin up new malware. The barrier to entry keeps dropping, and with it, a flood of new campaigns from wannabe threat actors who want C2 infrastructure without any of the work. Their go-to? Telegram bots.

Telegram bots as C2 aren't new, actors have been doing this for years. But after I dropped "Matkap", we could pull stolen logs straight from the bots by snagging bot credentials out of malware samples and phishing kits. That actually pushed a bunch of families off Telegram for a while. XWORM, Snake Keylogger, VIPKeylogger, and others all moved on.

Then the AI-written stuff started flooding in. Logs from dozens of new campaigns kept pouring into Matkap, and after digging through them for a while, I figured it was time to write this up.

The Close Relationship Between Telegram Bots and Threat Actors: New Stealers, Hunters Becoming the Hunted

Analysis of newly discovered AI-written stealer malware families using Telegram bots as C2 infrastructure

cti.monster

 

[Divergent]

Executive Summary

Confirmed Facts
Telemetry indicates a significant volume of infostealer and RAT malware families (including Phantom Stealer, Unix Stealer, and Blank Grabber forks) utilizing Telegram bots as their primary Command and Control (C2) infrastructure for data exfiltration.

Assessment
The barrier to entry for cybercrime has been lowered by the availability of open-source malware and AI tools, leading to an influx of low-tier threat actors who often misconfigure their payloads, occasionally infecting their own systems or targeting analysis sandboxes.

Technical Analysis & Remediations

MITRE ATT&CK Mapping

TA0006
Credential Access (OS Credential Dumping, Credentials from Password Stores)

TA0009
Collection (Data from Local System)

TA0010
Exfiltration (Exfiltration Over Web Service)

CVE Profile
Unknown [NVD Score: N/A]
[CISA KEV Status: Inactive]
(No specific vulnerabilities exploited; relies on execution and local file access).

Telemetry

File Paths/Artifacts
C:\Users\NAYTILYS\AppData\Local\Temp\stolen_data.zip, %LOCALAPPDATA%\Temp\, <path_hash>@<COMPUTERNAME>.zip.

Constraint
The structure indicates commodity infostealer behavior, prioritizing the harvesting of browser data, messaging sessions (specifically Telegram tdata), and system enumeration before compressing and exfiltrating the archive.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Review acceptable use policies regarding unauthorized applications and messaging platforms on corporate devices.

DETECT (DE) – Monitoring & Analysis

Command
Implement SIEM alerts for unusual outbound traffic to Telegram API endpoints (api.telegram.org), especially from non-standard processes.

Command
Hunt for creation of anomalous .zip or .rar files in user %TEMP% or %LOCALAPPDATA% directories, matching patterns like Blank-[username].rar.

RESPOND (RS) – Mitigation & Containment

Command
Isolate identified hosts from the corporate network immediately.

Command
Terminate unauthorized processes interacting with browser data stores or messaging application data.

RECOVER (RC) – Restoration & Trust

Command
Force global password resets for all accounts authenticated on the compromised host.

Command
Reimage affected machines to ensure complete eradication of the payload and any potential persistence mechanisms.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Deploy Endpoint Detection and Response (EDR) solutions configured to block unauthorized access to browser credential stores and tdata directories.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect from the internet immediately if anomalous system behavior or unexpected archive creation is observed.

Command
Do not log into banking/email until verified clean.

Priority 2: Identity

Command
Reset passwords and revoke session tokens (especially Discord and Telegram) using a known clean device (e.g., phone on 5G).

Priority 3: Persistence

Command
Check Scheduled Tasks, Startup Folders, and Browser Extensions for unknown entries.

Command
Run a comprehensive scan using a reputable anti-malware solution.

Hardening & References

Baseline
CIS Benchmarks for Windows 10/11 (Focus on Account Policies and Local Policies).

Framework
NIST CSF 2.0 (PR.DS-01, DE.CM-01, RS.MA-02).

Source

CTI Monster