Do Son Point Wild uncovered Shuyal Stealer, a sophisticated infostealer targeting 19 browsers. It disables Windows Task Manager via a registry key and exfiltrates data via Telegram Bot API.
Telegram C2
The Cavalry Werewolf APT is using FoalShell reverse shells and StallionRAT backdoors, controlled via Telegram, to target Russian state agencies and energy/mining firms.
The Lone None group uses fake copyright notices to deliver a new stealer malware that focuses on crypto theft via clipboard replacement and utilizes Telegram for C2.
Cyfirma uncovers "Octalyn Forensic Toolkit," a GitHub-hosted "educational" tool that's actually a modular credential stealer exfiltrating data via Telegram.