External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2026-08-02 07:21:10 -04:00
committed by GitHub
parent 220c967f8f
commit 3e3d9dca82
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Iranian APT/Charming Kitten/README.md
+24
View File
@@ -100,6 +100,30 @@ This enhancement demonstrates an alternative command and control architecture th
<img width="968" height="172" alt="Screenshot From 2026-08-02 04-50-00" src="https://github.com/user-attachments/assets/8fc7216b-3efe-4be0-bd01-0af313fac92c" />
---
To simulate the communication workflow observed during the analysis, I created a dedicated Telegram bot using **BotFather**, Telegram's official bot management service. Unlike traditional command and control infrastructures that depend on dedicated servers, fixed IP addresses, or custom domains, this simulation communicates exclusively through the Telegram Bot API over encrypted HTTPS connections.
Following the same communication model, I configured the bot with the **Display Name** `Olalampo` and the **Username** `stager_51_bot`. The bot token generated by BotFather serves as the authentication mechanism, allowing BEAR C2 to establish communication with the Telegram Bot API without requiring a dedicated C2 server. This approach demonstrates how cloud messaging platforms can be incorporated into adversary simulations to emulate alternative command and control architectures.
<img width="2423" height="1920" alt="image_(1)" src="https://github.com/user-attachments/assets/96e06e84-3208-4b2c-935a-b48ca7dd0620" />
`Telegram API Setup`
To enable BEAR C2 to communicate with the Telegram account controlling the bot, I generated a Telegram **API ID** and **API Hash** through Telegram's developer portal. After registering a new application, these credentials were configured inside BEAR C2, allowing the framework to authenticate and interact with the Telegram account used throughout the simulation.
`CHAR.cpp Configuration`
The final stage consisted of configuring the Telegram communication module inside **CHAR.cpp**. The **Bot Token** generated by BotFather was embedded into the agent, allowing it to authenticate with the Telegram Bot API and establish bidirectional communication with the operator.
<img width="898" height="122" alt="image_(3)" src="https://github.com/user-attachments/assets/2a92081e-6158-4174-846e-e908e1074255" />
Since Telegram limits a single text message to **4096 characters**, the maximum message size was configured to **4000 characters** to provide a safe transmission margin. Whenever a command produces output larger than the configured limit, **CHAR.cpp** automatically splits the data into multiple sequential messages before transmitting them. This mechanism ensures reliable delivery of large command outputs while remaining fully compatible with the Telegram Bot API and maintaining continuous communication throughout the simulation.
---
**`main()`:**
Serves as the entry point of the payload and initializes the entire agent. After startup, it continuously communicates with the configured Telegram bot, periodically checking for new operator messages. Every incoming command is processed through the command dispatcher, while responses are returned back to the operator through the same communication channel. This continuous polling mechanism allows the agent to remain responsive throughout its execution.