(THREAD): Did you find a #phishing page or a piece of #malware using @telegram for exfil? Here are some useful techniques to grab additional intel on these artifacts. @JCyberSec_ @sysgoblin @dave_daves @PhishKitTracker @urlscanio @nullcookies @ninoseki 
1/9 Look for any strings or traffic that call out to api.telegram.org . If you see something like: 'api.telegram[.]org/bot12345:base64key/endpoint?chat_id=-12345', you're in business
5/9 If the bot is an administrator.. why not generate a chat link? core.telegram.org/bots/api#expor…
6/9 Be mean about it. Make the bot leave the chat and disrupt some ops.. core.telegram.org/bots/api#leave…
8/9 And the really interesting one, although I've had mixed results. Set a webhook on the bot! If the actor has not-so-great opsec on the bot, you can get messages and people interacting with the bot sent to your own webhook! core.telegram.org/bots/api#setwe…
9/9 Thats all I got. Happy hunting!
If you have a #phishing page or #phishingkit and need help analyzing, shoot me a tweet or a DM. Have some great open source stuff coming through the pipe to reverse engineer kits.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
