AI
Why Malware Moves to Trusted Platforms
Threat actors are shifting from buying domains and hosting C2 servers to using free trusted platforms. Telegram offers high availability, encryption, and anonymity. Malware embeds a Telegram bot token and chat ID. Instead of connecting to a suspicious domain, it calls api.telegram.org. This blends with legitimate traffic and avoids traditional network detections. The bot token is the single credential that controls all communications.
Extracting the Bot Token: From Phishing Email to Telegram C2
A DHL phishing email from no-reply@windhym.site contained a JavaScript file. That file downloaded a PowerShell script that wrote an executable to disk. The executable spawned regasm.exe, injected the Nova info stealer payload, and sent stolen data to Telegram. Using dnSpy, Folland decompiled the .NET binary and found the bot token and chat ID in plain text. Nova info stealer also supports FTP and SMTP exfiltration.
Intercepting the C2 Channel: Forwarding Messages
Folland used Any.Run’s prepare bot script to add the threat actor’s bot to his own Telegram chat. The getUpdates API returned his chat ID. He then ran the forwardMessages script with the source (attacker’s) and destination (his) chat IDs. The script iterated through all message IDs and forwarded every message. The result was a complete copy of the C2 channel containing thousands of screenshots and key logs.
Inside the Threat Actor’s Desktop: Screenshots, Credentials, Infrastructure
The first screenshots showed phishing page source code and the same DHL email Folland analyzed. The attacker had tested the malware on his own production machine. Screenshots revealed additional domains (bionn.com, docuign), Cloudflare dashboard, root SSH credentials in Notepad, and a mass email tool sending 35,000 messages at once. The attacker reused hostnames across campaigns, enabling high-fidelity detection.
Simple Intelligence Wins from OpSec Mistakes
VirusTotal’s relations tab often exposes embedded bot tokens and chat IDs without any manual analysis. Searching for “api.telegram.org” in VirusTotal or Google dorking against sandbox reports yields samples with usable tokens. The technique is not novel, but the intelligence gains are massive. Storing all passwords in plain text, reusing hostnames, and testing malware on the same machine used for attacks are repeatable opsec failures that defenders can exploit.
Notable Quotes
“I was expecting this to be victim data” Ben Folland · ▶ 22:02
“we’ve just compromised this threat actors telegram chat” Ben Folland · ▶ 23:15
“they’re not using a password manager” Ben Folland · ▶ 26:47
“threat actors rarely change the host names of their machines” Ben Folland · ▶ 14:29
“this isn’t a novel technique” Ben Folland · ▶ 32:17
Key Takeaways
- One Telegram bot token can expose an entire cyber crime operation.
- OpSec failures like storing passwords in Notepad reveal full infrastructure.
- VirusTotal relations tab often surfaces bot tokens without deep analysis.
About the Speaker(s)
Ben Folland is a Security Operations Analyst at Huntress, where he manages hands-on-keyboard intrusions and dismantles active threats daily. Before that, he worked at one of Accenture’s SOCs, defending UK Critical National Infrastructure, gaining deep experience in high-stakes environments. He’s all about DFIR, malware analysis, and threat hunting—and has a knack for exposing adversary tradecraft. Ben’s spoken at over 10 conferences (including six BSides), taught SOC workshops at universities, is GIAC GCFA certified, and was a finalist for the UKs national cyber team. Whether it’s CTFs or live incidents, Ben thrives on the chase and brings a hacker mindset to everything he does.