TI-2026-063B — Three Faces of Telegram: One Platform, Three Roles in the Attack Chain

Classification: MEDIUM–HIGH · Forensic threat intelligence · Synthesis · Published 2026-07-07 · Series: The Trusted Channel

TI-2026-063A caught one implant using Telegram as command-and-control. But that is only one of the ways Telegram shows up in this honeypot's threat record. Read across the corpus and the same platform plays three different roles in the attack chain — the thing being stolen, the courier carrying stolen goods, and the hand on the controls. This part maps all three, because the pattern is the finding: a single trusted consumer app has become load-bearing infrastructure for unrelated criminal operations, each abusing it in a different way for the same reasons.

1. Role One — The Loot (Telegram as target)

In TI-2026-007 "The Underground Economy", attackers who gained shell access went looking for one prize in particular: Telegram Desktop session data. The tell was a hunt for ~/.local/share/TelegramDesktop/tdata and the string D877F783D5D3EF8C — a Telegram auth_key fingerprint (the lower 64 bits of SHA1(auth_key)), with the trailing s that Telegram Desktop appends to the tdata/ subdirectory. Someone was being hunted across the internet by the specific account they wanted.

Here Telegram is the objective. Stealing a victim's tdata hijacks their live Telegram session — no password, no 2FA prompt, full access to their chats, contacts and any channels they administer. For an account tied to money (crypto groups, marketplace admins), that session is the payday.

2. Role Two — The Courier (Telegram as exfiltration channel)

In TI-2026-002 "MikroTik Recon & Telegram Stealer Botnet", 15 compromised residential devices across 14 countries ran an identical nine-step reconnaissance playbook — and exfiltrated the credentials they harvested via the Telegram Bot API. The bot's sendMessage endpoint was the getaway car: stolen data left each victim as an ordinary HTTPS request to api.telegram.org, landing in the operator's chat.

Here Telegram is the courier. It is not the target and not the controller; it is the outbound pipe that moves loot from victim to operator without a dedicated exfil server, without a suspicious destination domain, and without anything a data-loss-prevention blocklist recognises. The stolen credentials ride out on the same channel a million legitimate bots use.

3. Role Three — The Handler (Telegram as C2)

In TI-2026-063A "The Telegram Shell", the Bot API became bidirectional command-and-control. The implant polls getUpdates for instructions (CMD → sh -c → output) and answers via sendMessage. The operator drives a fleet of compromised boxes from a phone.

Here Telegram is the handler. Not the loot, not just the exit pipe, but the full control plane: commands in, results out, over one TLS channel to a service no firewall blocks. This is the role that most completely replaces traditional attacker infrastructure — there is no C2 server to seize because Telegram is the C2 server.

4. The Pattern

Three unrelated operations, three roles, one platform — and the reasons are identical every time. Telegram is ubiquitous (never blocked at the firewall), TLS-encrypted (invisible to netflow inspection), free and instant to provision (a bot in thirty seconds from @BotFather), and it anonymises the operator behind Telegram's own accounts and infrastructure. Whether an attacker wants to steal a Telegram identity, use Telegram to carry stolen data, or command victims over Telegram, the platform's properties make it the path of least resistance. MITRE ATT&CK catalogues the C2/exfil variants as T1102 (Web Service) — the honeypot simply shows all of them converging on one app.

5. Alternative Interpretation

Steelman: "Three dossiers mentioning Telegram is not a pattern — it is a popular app appearing in three unrelated cases. Grouping them manufactures a theme out of coincidence."

Why the three-role map holds:

• It is a claim about the platform, not the actors. The map explicitly does not say TI-2026-002, 007 and 063A are the same operator — they are separate campaigns with different tooling and origins. The finding is that one platform is structurally useful across the whole attack chain, which is a statement about Telegram's properties, not about a cabal.
• The three roles are functionally distinct, not repetitive. Loot, courier and handler are different verbs — steal it, send through it, command over it. That three separate operations independently reached for the same app for three different jobs is exactly what "load-bearing infrastructure" looks like.
• It generalises the defense. The value of the map is operational: the same egress control that stops the C2 (§6) also stops the courier, and monitoring tdata access catches the loot. Seeing the three together is what makes one policy cover all three.

What is not claimed: a shared operator, or that Telegram is uniquely culpable (Discord, Pastebin and other trusted services fill the same roles — Telegram is simply the one this honeypot captured most). Confidence: MEDIUM–HIGH — HIGH that the three roles are real and distinct across the cited dossiers; MEDIUM that "one platform, whole kill chain" is the right framing rather than three coincidences (the functional distinctness and the shared rationale argue it is a pattern).

6. Defense Response

• One egress policy covers courier and handler. Servers with no business reaching api.telegram.org should be blocked from it outbound. That single allow-list denies both the exfil channel (Role 2) and the C2 (Role 3) at the network edge — the only reliable control against a trusted-service channel, since the destination is legitimate and the traffic is TLS.
• Monitor the loot directly. Access to ~/.local/share/TelegramDesktop/tdata (and find commands hunting for it) is a high-signal indicator of Role 1 session theft on any host where a human uses Telegram Desktop. Protect and monitor that path.
• The behavioural tells are shared. Non-browser processes talking to api.telegram.org, and the sendMessage / getUpdates / sendDocument endpoints appearing in shell history or process telemetry, indicate courier or handler activity regardless of the specific malware. (SIGMA detection content for exactly this is covered in TI-2026-063C.)
• Report the bots. Every role that uses a bot has a bot ID; reporting it to Telegram removes that operation's channel. For 063A that was bot 8063945940.

7. Investigation Metadata

Cristian Lișneanu · shuffle-on.com · Threat Intelligence