New ResokerRAT Uses Telegram Bot API to Control Infected Windows Systems

ResokerRAT is a Windows Remote Access Trojan that abuses the Telegram Bot API for stealthy command-and-control; it supports screen capture, keylogging, privilege escalation, Task Manager/process termination, persistence via Run registry, UAC weakening, and downloading additional payloads. The report details anti-analysis behaviour (IsDebuggerPresent, custom exception handling), a mutex named "Global\ResokerSystemMutex", use of SetWindowsHookExW for a global keyboard hook, and hardcoded Telegram bot token/chat ID polling. Recommended mitigations include monitoring outbound traffic to Telegram API endpoints, restricting PowerShell execution, and keeping endpoints and security software updated.