Instant Messaging-Based Adversarial C2 Techniques and How to Detect Them

This report explains how threat actors use Telegram and Discord APIs as covert C2 channels, the detection challenges they present, common indicators such as API endpoint connections, external IP lookup calls, unusual HTTP User-Agents, and suspicious process behaviors, and recommends behavioral-based detection and process monitoring to identify such abuse.