Mythic C2 profile that tunnels Athena and Apollo agent traffic through Telegram bot-to-bot messages, bridging encrypted payloads to Mythic via its Push C2 gRPC service.
Telegram provides a Mythic C2 profile for the Athena and Apollo agents. It uses Telegram private bot-to-bot messages as a transport and Mythic's Push C2 gRPC service as the controller bridge.
Athena or Apollo agent bot <-> Telegram Bot API <-> controller bot <-> Telegram C2 service <-> Mythic
Each running agent uses its own Bot API token. The C2 service uses one controller bot token. Both bots must have Telegram's Bot-to-Bot Communication Mode enabled.
Messages use a small JSON envelope and are split into 2,800-character chunks before they are sent through sendMessage. Agent payloads retain their aes256_hmac encryption; the Telegram service forwards encrypted Mythic messages without decrypting them.
Run this command from the Mythic directory:
./mythic-cli install github https://github.com/DavidCarliez/mythic_telegram_profile
For local development, install the checkout instead:
./mythic-cli install folder /path/to/telegram -f
Install one of the supported agent forks in the same Mythic deployment:
# Athena
./mythic-cli install github https://github.com/DavidCarliez/Athena -b telegram-c2
# Apollo
./mythic-cli install github https://github.com/DavidCarliez/Apollo -b telegram-c2
getUpdates consumers share one update queue.Private bot-to-bot messages require the communication mode on both bots. Telegram documents the requirement in its Bot-to-Bot Communication guide.
In Mythic, open C2 Profiles, expand the actions for telegram, and select View/Edit Config. Set:
| Key | Value |
|---|---|
botToken | Controller bot token from BotFather |
apiBase | https://api.telegram.org unless using a compatible local Bot API server |
pollTimeout | Long-poll timeout from 1 through 50 seconds |
mythicGrpc | Mythic Push C2 gRPC endpoint; keep the supplied value for a normal Mythic deployment |
Save the config, then start the profile.
Select the telegram C2 profile while building Athena or Apollo and provide:
| Parameter | Description |
|---|---|
bot_token | Token for the payload's dedicated agent bot |
controller_bot | Controller bot username, with or without @ |
api_base | Telegram Bot API base URL |
message_checks | Maximum long polls while waiting for each controller response |
time_between_checks | Long-poll timeout in seconds |
callback_interval | Agent callback interval in seconds |
callback_jitter | Agent callback jitter percentage |
AESPSK | aes256_hmac message encryption |
user_agent | HTTP User-Agent sent to Telegram |
proxy_* | Optional HTTP proxy settings |
killdate | Payload expiration date |
AESPSK enabled.getUpdates calls would consume each other's responses.Each Telegram text message contains a JSON object with these fields:
v: protocol version, currently 1sender_id: random route identifier generated by the agent processclient_id: response route identifierto_server: direction flagpacket_id: chunk set identifierreply_to: request identifier acknowledged by a controller responsesleep: current agent callback interval in secondsjitter: current agent callback jitter percentagechunk: zero-based chunk indexchunks: total chunk count, limited to 256message: encrypted Mythic message fragmentIncomplete chunk sets expire after ten minutes.