HEAVYGRAM C2 via Telegram Bot API getUpdates Long-Polling

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•0

Detects outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of long-polling command and control (C2) communication. This behavior is associated with the HEAVYGRAM malware and its use of Telegram as a C2 channel.