Y2K Operators: Millenium RAT v4 (C++) Telegram C2 Campaign — OTX Pulse Analysis

title: Potential Millenium RAT C2 Traffic via Telegram API
id: 26c5ce3a-1f3b-4c8a-9b6d-5e7f8a1b2c3d
description: Detects potential C2 traffic by suspicious processes connecting to Telegram API, a technique used by Millenium RAT v4 and other Telegram-abusing malware.
author: Security Arsenal
date: 2026/07/25
references:
    - https://otx.alienvault.com/pulse/6273829c
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: 'api.telegram.org'
    filter_legit:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\telegram.exe'
            - '\msedge.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate applications using Telegram for notifications (rare without specific allowlisting)
level: high
tags:
    - attack.command_and_control
    - attack.t1102
---
title: Millenium RAT Download Infrastructure Connection
id: 45d2e1b4-6a8f-4e9d-8c3f-0a1b2c3d4e5f
description: Detects outbound connections to known Millenium RAT download infrastructure blackhatusa.com.
author: Security Arsenal
date: 2026/07/25
references:
    - https://otx.alienvault.com/pulse/6273829c
status: experimental
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: 'blackhatusa.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.initial_access
    - attack.t1190
---
title: Suspicious Process Execution - Millenium RAT Filenames
id: 67f3c2d5-8b9a-5e0f-1d4e-2a3b4c5d6e7f
description: Detects execution of processes with filenames associated with Millenium RAT droppers (update.exe, clip.exe, setup.exe) from user directories.
author: Security Arsenal
date: 2026/07/25
references:
    - https://otx.alienvault.com/pulse/6273829c
status: experimental
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\update.exe'
            - '\clip.exe'
            - '\setup.exe'
    selection_path:
        CurrentDirectory|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Desktop\'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates (verify publisher)
level: medium
tags:
    - attack.execution
    - attack.t1204


kql
// Hunt for connections to known C2 domains
DeviceNetworkEvents
| where RemoteUrl has "blackhatusa.com" or RemoteUrl has "api.telegram.org"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFolderPath, RemoteUrl, RemoteIP
| order by Timestamp desc

// Hunt for specific file hashes on endpoints
DeviceProcessEvents
| where SHA256 in ("ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736", "a1c160243efd54a9bf00655966971aae")
| project Timestamp, DeviceName, AccountName, FolderPath, SHA256, InitiatingProcessCommandLine
| order by Timestamp desc


powershell
# IOC Hunt Script for Millenium RAT
# Checks for the presence of specific file hashes and active network connections to Telegram

$TargetHashes = @(
    "ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736",
    "a1c160243efd54a9bf00655966971aae"
)

Write-Host "[*] Checking for Millenium RAT Indicators of Compromise..."

# Scan common directories for the files
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:USERPROFILE\Desktop")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host "[*] Scanning $Path..."
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
            }
        }
    }
}

# Check for active connections to Telegram API
Write-Host "[*] Checking active network connections to api.telegram.org..."
$Connections = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -ne "0.0.0.0" -and $_.State -eq "ESTABLISHED" }
foreach ($Conn in $Connections) {
    try {
        $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction Stop
        $RemoteHostName = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress).HostName
        if ($RemoteHostName -like "*telegram*") {
            Write-Host "[!] Suspicious Connection: PID $($Process.Id) - $($Process.ProcessName) connected to $RemoteHostName ($($Conn.RemoteAddress))" -ForegroundColor Yellow
        }
    } catch {
        # Ignore resolution errors
    }
}