TELEGRAM ABUSED AS C2 CHANNEL FOR NEW GOLANG BACKDOOR

Summary from the TLDR InfoSec newsletter

Researchers at Netskope have discovered a Golang-based malware, likely Russian in origin, that uses Telegram API as a Command and Control Mechanism. It uses the "C:\Windows\Temp\svchost.exe" location to save the binary and listens to commands in a Telegram Channel. This blog post includes the IOCs in a GitHub repository as well as screenshots of decompiled code of the malware.