Telegram Bot API sendMessage call from server infrastructure (Exvicy TG notify)

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects outbound HTTP requests to the Telegram Bot API (/sendMessage) which are often used by malware (such as 'Exvicy' or 'Small Sieve') for command and control or exfiltration notification, utilizing the Telegram bot token structure in the URI.