KuinaExtractor Telegram Bot API Data Exfiltration (>500KB)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects anomalous, high-volume data transfers to Telegram API endpoints (api.telegram.org, specific IP ranges), which is indicative of data exfiltration by malware such as KuinaExtractor. The rule monitors for cumulative outbound traffic exceeding 500MB within a 1-hour session window per process.