Platform Abuse
XWorm and Telegram
Two distinct concepts: distribution/marketing via underground Telegram communities, and operational Telegram use in modified/trojanized builds.
AUTHOR: Threat Intelligence Research TeamUPDATED: 2026-10-04VERIFIED: 2026-10-04
1. Distribution & marketing
XWorm distribution/marketing has historically involved underground Telegram communities.
2. Operational use (modified builds)
Modified or trojanized XWorm-related builds have also used Telegram infrastructure operationally.
Do not overgeneralize
Do not state "Telegram is the XWorm C2 protocol" as a universal rule. Core XWorm campaigns frequently use direct C2 infrastructure. Telegram is a legitimate communications platform that can be abused by criminal operators.
