HEAVYGRAM/CHOSEN BRICK Telegram C2 Proxy Domain Observed (iproyal/lightningproxies)

Arnold Chan@slaz

•updated 24 days ago•0•0•3

Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.