BQTLock Telegram Bot API C2 - Non-Browser Process Contacting api.telegram.org

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects network communication to the Telegram Bot API (api.telegram.org) initiated by processes other than standard web browsers. This behavior is indicative of malicious activity such as automated data exfiltration, C2 communication, or victim status reporting, as observed in ransomware campaigns like BQTLock.