VMRay Labs Note. By Julian Wolf, VMRay Labs. 16.09.2026
Key finding. VMRay Labs analyzed a new remote access trojan, “Astral C2,” that uses Telegram as its only command-and-control channel, first seen on VirtualPublic malware repositories on 13 September 2026. What stands out is its range: a single implant, controlled through an ordinary Telegram bot, gives an operator both smash-and-grab data theft and the tooling for a deliberate, hands-on intrusion. Routing control through Telegram also lets it slip past detection that relies on flagging suspicious domains, because the traffic goes to a service organizations use every day.
What was observed
Astral C2 communicates entirely through the Telegram Bot API. It polls the getUpdates endpoint for operator commands and uses sendMessage and sendDocument to exfiltrate what it collects. It stays dormant until told to act, activating malicious behavior only on an operator command, which helps it avoid drawing attention before it is needed.
Its capabilities split into two tiers. Basic functions, keylogging, implant status, and an interactive shell, run over plaintext commands. The advanced functions are driven through dedicated operator tooling and run encrypted: credential theft (from browsers and applications, including LSASS memory dumping), privilege escalation, screenshot, webcam, microphone, and clipboard capture, lateral movement, code injection, anti-forensics, and SOCKS5 proxy and port-forwarding. In other words, the same implant serves a quick credential grab and a patient, deeper compromise.
The sample VMRay analyzed carried targeting for game cheats, cryptocurrency exchanges, email providers, and Russian banks, a spread that fits both opportunistic theft and more selective operations.
Why it matters
The technique that carries the risk here is the C2 channel itself. When malware talks to its operator through Telegram, its traffic goes to api.telegram.org, a legitimate, widely trusted destination. Detection that works by blocking suspicious domains and IPs has little to catch, because there is no suspicious address in the conversation. Telegram is an increasingly common choice for exactly this reason, across both malware and phishing.
That makes the channel the practical control point. VMRay Labs recommends that teams monitor or block Telegram API access (api.telegram.org) where their environment allows it, since the same property that makes it convenient for operators, blending with normal traffic, is what makes it hard to catch by other means. Behavioral analysis remains the reliable way to surface this activity, because the theft, the escalation, and the exfiltration are visible in what the implant does at runtime, regardless of how ordinary its network destination looks.
FAQ
What is Astral C2? A newly identified remote access trojan that uses Telegram as its sole command-and-control channel, offering an operator both data-theft and full intrusion capabilities from a single implant.
Why do attackers use Telegram for command-and-control? Because the malware’s traffic goes to a legitimate, trusted service. Detection that relies on flagging suspicious domains or IP addresses has nothing obviously malicious to block.
How can defenders respond? Where the environment allows, monitor or block access to the Telegram API (api.telegram.org). More broadly, behavioral analysis catches this activity because the malicious actions are visible at runtime even when the network destination looks benign.
Indicators of compromise
SHA256: f904536a1ea124fc9d0f2e58862690b3254703de78b79196d0a0735e927aa143
C2: hxxps[:]//api[.]telegram[.]org/bot8943612540:AAG0J2fqQC21igji3gD5gabJu-t5fvPRCz4
