The Detection & Response Chronicles: Exploring Telegram Abuse

This NVISO report documents active abuse of Telegram by multiple malware families — including DeerStealer, Raven Stealer, Lumma, Lunar Spider and a trojanized XWorm builder — for victim monitoring, command-and-control, and data exfiltration via the Telegram Bot API and channels; it includes campaign details, numerous IOCs (domains and hashes), and KQL hunting queries for detection and mitigation.