CampaignPublished 21 May 2025

How Adversary Telegram Bots Help to Reveal Threats: Case Study

Source AlienVault OTX General

Description

This analysis examines a phishing campaign targeting Italian and US users, focusing on credential harvesting for Microsoft services and Italy's PEC system. The attackers use Notion workspaces and other cloud platforms to host phishing pages, exfiltrating stolen data via Telegram bots. The campaign, active since 2022, employs simple techniques and off-the-shelf tools, suggesting either low technical expertise or a focus on access brokering. The study demonstrates how intercepting Telegram bot communications can aid in profiling threat actors and provides insights into the campaign's evolution, victimology, and attacker characteristics.

Impact

For European organizations, especially those in Italy, this campaign poses a significant risk to the confidentiality of sensitive information due to credential theft targeting Microsoft services and the PEC system, which is widely used for secure and legally binding communications in Italy. Compromise of PEC credentials can lead to unauthorized access to official communications, legal documents, and sensitive business data, potentially resulting in reputational damage, financial loss, and regulatory penalties under GDPR. The use of cloud platforms like Notion for hosting phishing pages complicates detection and takedown efforts, as these platforms are legitimate services with high availability and trust. The exfiltration via Telegram bots further obfuscates attacker activity, making incident response and forensic investigations more challenging. Additionally, the campaign's persistence since 2022 indicates ongoing risk and potential for expansion to other European countries using Microsoft services extensively. Organizations relying heavily on Microsoft 365 and similar cloud services are at risk of account compromise, which could lead to lateral movement within networks, data breaches, and potential ransomware deployment by secondary threat actors who purchase access. The campaign's relatively low technical complexity suggests it could be widely adopted by less sophisticated threat actors, increasing the volume of attacks and potential victims.

Defensive guidance

1. Implement advanced email filtering solutions that specifically target phishing attempts leveraging cloud-hosted pages, including heuristic and URL reputation analysis focused on platforms like Notion. 2. Enforce multi-factor authentication (MFA) on all Microsoft and PEC accounts to reduce the risk of credential misuse even if passwords are compromised. 3. Monitor outbound network traffic for unusual connections to Telegram API endpoints, especially from endpoints that do not typically use Telegram, to detect potential data exfiltration via Telegram bots. 4. Conduct targeted user awareness training focused on recognizing phishing attempts that use legitimate cloud services and emphasize the risks associated with PEC and Microsoft credential theft. 5. Deploy endpoint detection and response (EDR) tools capable of detecting scripting and command interpreter abuse (e.g., PowerShell, cmd) that may be used to automate credential capture or exfiltration. 6. Collaborate with cloud service providers to report and expedite takedown of malicious Notion workspaces and other cloud-hosted phishing infrastructure. 7. Utilize threat intelligence feeds that include indicators of compromise related to this campaign to proactively block known phishing URLs and Telegram bot identifiers. 8. Regularly audit and review access logs for PEC and Microsoft services to identify anomalous login patterns indicative of credential compromise.

Indicators of compromise

Domains 6

aedsrl.it
goetsch-transporte.it
gruppoamag.it
hampshiredownsheepwales.com
steelsystembuilding.it
25348255-1243060.renderforestsites.com

Hashes 11

1c37ff25a354805f8dd0eed23673d4e8
2049afb27b7d71b311ef83205ec8c1397ed9b705b4f84517471cc41c8c1f29d1
2969a13ecc2540287fe0f2971bc523c5668781944e5daad34d23e1291a3e67f3
7bfccbc16df79c1b837b764bb19f15400b9be80f0d3d88130dbeba1e1965c5ae
7e5a3bb0cff67b2c1ff50544f956a903a6ff364c006033c0887d17019875040e
8a1cecaf7c6df616fae15dca013cea78d209f0e813b9aa75964de1f813d614e0
a2346c9d602323359f99007eac73bc3bf4d62d0fed1af2e3e20e9a7d74cbf190
a5ca3ceebe83e4049ed5affc3403ddc2030ba0fad80392895df2f50711ad54ce
b1145accfe9485052186f5db3507a3ebd8796b8246bee3990711dc2381c703b4
f31113f3167e1d62f1908bf366892576cd521e0122a76d5f79eefaa9764e5d04

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jun 2025, 13:53 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 6

Hashes 11

Community reviews

Related threats