ResokerRAT Uses Telegram Bot API to Control and Persist on Windows Hosts

K7 Security Labs identified ResokerRAT, a Windows remote access trojan that uses Telegram’s Bot API as its command-and-control channel instead of dedicated attacker infrastructure. The malware, delivered as Resoker.exe, polls Telegram endpoints such as getUpdates with hardcoded bot credentials and chat IDs, allowing commands and stolen data to move over trusted HTTPS traffic to api.telegram.org, which can make network-based detection more difficult.

Researchers said the malware supports screen capture, keylogging, file download, privilege escalation, and persistence, while also attempting to evade analysis and disrupt defenders. ResokerRAT creates a mutex, checks for debuggers, relaunches with administrator rights, blocks tools including Task Manager and Process Hacker, weakens UAC-related settings, and adds itself to the Windows Run registry key for startup execution. Defenders were urged to monitor suspicious outbound Telegram API traffic, Run key persistence, restricted PowerShell activity, and user reports that security or system tools suddenly cannot be opened.