Instant Messaging-Based Adversarial C2 Techniques and How to Detect Them
Summary: Dragos reports a rising trend in offensive tooling that uses the Telegram and Discord APIs as command-and-control channels, with traffic flowing to endpoints such as https://telegram.org/api and https://discord.com/api. Many of these toolkits first perform an external IP lookup for the victim device through services like ipify, and detection depends on behavioral signals such as unusual User Agents, telegram.exe or discord.exe dropping files or spawning processes, and Windows-like processes with mismatched metadata or missing Microsoft signatures.
Bottom line: Dragos found that 50% of its 2022 service engagements had a finding related to improper network segmentation, so a C2 channel established in IT can be the path adversaries use to move laterally into OT networks where patching is constrained by maintenance windows and 20- to 30-year asset lifecycles.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026