Telecrypt ransomware abuses Telegram Messenger’s communication protocol

Telecrypt ransomware is a new malware that abuses the instant messaging service Telegram for command and control (C&C) communications.

Security experts from Kaspersky Lab have spotted a new Ransomware, called Telecrypt (Trojan-Ransom.Win32.Telecrypt), that abuses the Telegram instant messaging service for communications with command and control (C&C).

The Delphi-written Trojan, which is currently targeting only Russian users, it exploits the Telegram Messenger’s communication protocol to send a decryption key to the attackers.

Once infected a machine, Telecrypt ransomware generates a file encryption key and an infection ID. It creates a Telegram bot and exploits the Telegram API to send infection data to the C&C infrastructure.

Telecrypt notifies the successful infection to the C&C sending back data related to the compromised machine (i.e. Chat number, computer name, infection ID, and the seed for the encryption key).

“The Trojan then sends a request to the URL<token>/GetMe, where <token> the unique ID of the Telegram bot, created by the cybercriminals, is stored. According to the official API documentation, the method ‘getMe’ helps to check if a bot with the specified token exists and finds out basic information about it. The Trojan does not use the information about the bot that the server returns.” reads the analysis published by Kaspersky.

The Telecrypt ransomware then encrypts files with specific files in the local drives. The researchers noticed the ransomware sometimes uses the .Xcri extension for the encrypted files, otherwise it does not change it.

Once the encryption process is completed the Telecrypt Trojan downloads an executable file from a compromised WordPress website that displays the ransom note to the victims. The ransomware asks victims 5,000 RUB ($77) to recover the encrypted files, crooks accept payment via Qiwi or Yandex Money.

“Then the Trojan downloads the extra module Xhelp.exe (URL: http://***.ru/wp-includes/random_compat/Xhelp.exe) from a compromised site created using WordPress, and launches it. This module, called “Informer” (‘Информатор’ in the original Russian) by the cybercriminals, has a graphical interface and informs the victim about what has happened, and puts forward the ransom demand. The ransom is 5,000 RUB which is accepted via Qiwi or Yandex.Money payment methods.” continues the report published by Kaspersky.


The ransom page also allows victims to communicate with crooks by abusing the Telegram service.

Experts explained that the Telecrypt ransomware is not complex, for this reason, Kaspersky is working to crack it.

Pierluigi Paganini

[adrotate banner=”22″]

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.


10th Anniversary Exclusive Top 100 CISO Conference & Innovators Showcase