Telegram C2 profile for Mythic

Telegram provides a Mythic C2 profile for the Athena and Apollo agents. It uses Telegram private bot-to-bot messages as a transport and Mythic's Push C2 gRPC service as the controller bridge.

Architecture

Athena or Apollo agent bot <-> Telegram Bot API <-> controller bot <-> Telegram C2 service <-> Mythic

Each running agent uses its own Bot API token. The C2 service uses one controller bot token. Both bots must have Telegram's Bot-to-Bot Communication Mode enabled.

Messages use a small JSON envelope and are split into 2,800-character chunks before they are sent through sendMessage. Agent payloads retain their aes256_hmac encryption; the Telegram service forwards encrypted Mythic messages without decrypting them.

Requirements

• Mythic 3
• One supported agent fork with the Telegram transport:
  • Athena
  • Apollo
• One Telegram controller bot
• One Telegram bot for each concurrently running payload instance

Install

Run this command from the Mythic directory:

./mythic-cli install github https://github.com/DavidCarliez/mythic_telegram_profile

For local development, install the checkout instead:

./mythic-cli install folder /path/to/telegram -f

Install one of the supported agent forks in the same Mythic deployment:

# Athena
./mythic-cli install github https://github.com/DavidCarliez/Athena -b telegram-c2

# Apollo
./mythic-cli install github https://github.com/DavidCarliez/Apollo -b telegram-c2

Telegram setup

1. Use @BotFather to create the controller bot.
2. Create a separate bot for each payload instance that will run at the same time.
3. Enable Bot-to-Bot Communication Mode for the controller bot and every agent bot.
4. Record the controller bot token and username.
5. Record each agent bot token. Do not reuse a token for concurrent payloads because getUpdates consumers share one update queue.

Private bot-to-bot messages require the communication mode on both bots. Telegram documents the requirement in its Bot-to-Bot Communication guide.

Configure the C2 service

In Mythic, open C2 Profiles, expand the actions for telegram, and select View/Edit Config. Set:

Key	Value
botToken	Controller bot token from BotFather
apiBase	https://api.telegram.org unless using a compatible local Bot API server
pollTimeout	Long-poll timeout from 1 through 50 seconds
mythicGrpc	Mythic Push C2 gRPC endpoint; keep the supplied value for a normal Mythic deployment

Save the config, then start the profile.

Build a payload

Select the telegram C2 profile while building Athena or Apollo and provide:

Parameter	Description
bot_token	Token for the payload's dedicated agent bot
controller_bot	Controller bot username, with or without @
api_base	Telegram Bot API base URL
message_checks	Maximum long polls while waiting for each controller response
time_between_checks	Long-poll timeout in seconds
callback_interval	Agent callback interval in seconds
callback_jitter	Agent callback jitter percentage
AESPSK	aes256_hmac message encryption
user_agent	HTTP User-Agent sent to Telegram
proxy_*	Optional HTTP proxy settings
killdate	Payload expiration date

Operational constraints

• A Bot API token is a bearer credential. Restrict access and revoke it through BotFather after use.
• The agent token is embedded in the payload. Treat a recovered payload as a compromised token.
• Telegram transport is not end-to-end encrypted. Keep AESPSK enabled.
• Telegram retains message metadata and may retain message content under its service policies.
• This profile uses long polling, not webhooks.
• A single bot token must not be shared by concurrent agent instances. Their getUpdates calls would consume each other's responses.
• The controller accepts only bot-authored, versioned transport envelopes. Mythic encryption still provides message authentication and confidentiality.
• Agent requests remain pending until a correlated controller response arrives. Retried requests reuse the same request identifier, and the controller replays cached responses without forwarding duplicate traffic to Mythic.
• Mythic can push tasking when no agent request is pending. The controller queues that tasking and correlates it with the agent's next exchange instead of dropping it.
• The controller reports a route as disconnected after three missed maximum-jitter callback intervals plus 30 seconds, with a minimum timeout of 60 seconds.

Wire format

Each Telegram text message contains a JSON object with these fields:

• v: protocol version, currently 1
• sender_id: random route identifier generated by the agent process
• client_id: response route identifier
• to_server: direction flag
• packet_id: chunk set identifier
• reply_to: request identifier acknowledged by a controller response
• sleep: current agent callback interval in seconds
• jitter: current agent callback jitter percentage
• chunk: zero-based chunk index
• chunks: total chunk count, limited to 256
• message: encrypted Mythic message fragment

Incomplete chunk sets expire after ten minutes.