# The Bot Census: A Year Inside Malware's Telegram Ecosystem — Manuel Boll

**URL:** <https://discourse.ossbase.org/t/the-bot-census-a-year-inside-malwares-telegram-ecosystem-manuel-boll/1170>\
**Category:** 2026 talks / workshops\
**Tags:** talk, hack.lu, 2026\
**Created:** [October 7, 2026, 8:51am UTC](https://discourse.ossbase.org/t/the-bot-census-a-year-inside-malwares-telegram-ecosystem-manuel-boll/1170 "2026-10-07T08:51:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://discourse.ossbase.org/uploads/default/original/1X/4713f3d4fec85f7513775fc2dd36f548a49f8faa.jpeg) [@system](https://discourse.ossbase.org/u/system)\
**Post date:** [October 7, 2026, 8:51am UTC](https://discourse.ossbase.org/t/the-bot-census-a-year-inside-malwares-telegram-ecosystem-manuel-boll/1170/1 "2026-10-07T08:51:42Z")

</div>

**Join us at hack.lu 2026 — [Info & Registration](https://2026.hack.lu/info/)**

**Duration:** 30 min  
  
**Type:** Talk  
  
**Speakers:** Manuel Boll

**Abstract**

Over the past year, I collected thousands of Telegram bot tokens from VirusTotal and used them to study how threat actors abuse Telegram. This talk presents insights gathered from this unique dataset and examines how the role of Telegram within the malware ecosystem is changing over time. It also discusses the practical challenges of collecting, validating, and monitoring malicious Telegram bots at scale.

**Description**

Building on last year’s hack.lu presentation _Compromising Threat Actor Communications_ by Ben (@polygonben), this talk explores what can be learned from observing thousands of malicious Telegram bots at scale.

Over the past year I collected a steadily growing collection of unique Telegram bot tokens from malware samples published on VirusTotal, now spanning many thousands of distinct bots.

Telegram has become a popular platform for malware operators, but little is known about the ecosystem as a whole. Is it still growing as a malware communication channel, or has its popularity started to decline?

This presentation introduces the collection and analysis pipeline used to identify and monitor these bots at scale. More importantly, it presents the findings gathered from the dataset, and discusses the operational challenges of studying malicious Telegram infrastructure, including the limitations researchers run into when analyzing these systems.

[View on pretalx](https://pretalx.com/hack-lu-2026/talk/G8UAWE/)