Often, malware uses platforms like \u2014 Telegram and Discord for data exfiltration. Due to its simplicity and the lack of need for building a server architecture, this exfiltration method has gained significant popularity. However, this very simplicity is also its weakness. <\/p>\n\n\n\n
In this article we\u2019ll show you how to obtain information related to threat actors’ activities using Telegram API, which can help reveal their identity, attribute malware samples to known families or discover new ones. <\/p>\n\n\n\n
First, we need to find a relevant malware sample using Threat Intelligence Lookup<\/a> with the following query: <\/p>\n\n\n\n