Weaponization of Telegram, Discord, and Signal for C2 and Malware Delivery
Nation-state actors, including Iranian and Russian-linked groups, are increasingly leveraging mainstream communication platforms—specifically Telegram, Discord, and Signal—to facilitate Command and Control (C2) operations and malware delivery. By utilizing these high-reputation SaaS applications, attackers mask malicious traffic within legitimate, high-volume encrypted streams, effectively bypassing traditional Network Detection and Response (NDR) and Endpoint Detection and Response (EDR) solutions. Technical implementations include the Rust-based ChaosBot malware, which utilizes Discord’s API for corporate espionage, and various Telegram-integrated payloads. This tactical shift enables persistent C2 channels, facilitates intellectual property theft, and supports targeted surveillance of dissidents through the exploitation of trusted third-party infrastructures.