From 3e3d9dca826855cb0c70fa74f7f94ca536435737 Mon Sep 17 00:00:00 2001 From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com> Date: Sun, 2 Aug 2026 07:21:10 -0400 Subject: [PATCH] Update README.md --- Iranian APT/Charming Kitten/README.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/Iranian APT/Charming Kitten/README.md b/Iranian APT/Charming Kitten/README.md index 2b65b3d..2fc09d6 100644 --- a/Iranian APT/Charming Kitten/README.md +++ b/Iranian APT/Charming Kitten/README.md @@ -100,6 +100,30 @@ This enhancement demonstrates an alternative command and control architecture th Screenshot From 2026-08-02 04-50-00 +--- + +To simulate the communication workflow observed during the analysis, I created a dedicated Telegram bot using **BotFather**, Telegram's official bot management service. Unlike traditional command and control infrastructures that depend on dedicated servers, fixed IP addresses, or custom domains, this simulation communicates exclusively through the Telegram Bot API over encrypted HTTPS connections. + +Following the same communication model, I configured the bot with the **Display Name** `Olalampo` and the **Username** `stager_51_bot`. The bot token generated by BotFather serves as the authentication mechanism, allowing BEAR C2 to establish communication with the Telegram Bot API without requiring a dedicated C2 server. This approach demonstrates how cloud messaging platforms can be incorporated into adversary simulations to emulate alternative command and control architectures. + +image_(1) + + +`Telegram API Setup` + +To enable BEAR C2 to communicate with the Telegram account controlling the bot, I generated a Telegram **API ID** and **API Hash** through Telegram's developer portal. After registering a new application, these credentials were configured inside BEAR C2, allowing the framework to authenticate and interact with the Telegram account used throughout the simulation. + + +`CHAR.cpp Configuration` + +The final stage consisted of configuring the Telegram communication module inside **CHAR.cpp**. The **Bot Token** generated by BotFather was embedded into the agent, allowing it to authenticate with the Telegram Bot API and establish bidirectional communication with the operator. + +image_(3) + +Since Telegram limits a single text message to **4096 characters**, the maximum message size was configured to **4000 characters** to provide a safe transmission margin. Whenever a command produces output larger than the configured limit, **CHAR.cpp** automatically splits the data into multiple sequential messages before transmitting them. This mechanism ensures reliable delivery of large command outputs while remaining fully compatible with the Telegram Bot API and maintaining continuous communication throughout the simulation. + + +--- **`main()`:** Serves as the entry point of the payload and initializes the entire agent. After startup, it continuously communicates with the configured Telegram bot, periodically checking for new operator messages. Every incoming command is processed through the command dispatcher, while responses are returned back to the operator through the same communication channel. This continuous polling mechanism allows the agent to remain responsive throughout its execution.