Telegram bot exfiltration of Dahua camera credentials via send_photo

Ibrahim Saud@tektrix

•updated 25 days ago•0•0•7

Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.