Skip to main content

Netskope identifies a new Python RAT targeting gamers through Telegram

Source Decision Insights Coverage Published November 11, 2025 Companies 2
Human View Machine View

2 companies named across 6 categories, one of 127 articles referencing Netskope. Previous coverage: RedTiger infostealer targets gamers and Discord accounts (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Leader
Decision stage
How to start
Adoption curve
Early Majority

Our classification, not the publisher's statement. Best suited for, not only for.

Netskope's latest findings reveal a multi-functional Python Remote Access Trojan (RAT) utilizing the Telegram Bot Application Programming Interface (API) as its Command and Control (C2) channel. This threat may interest enterprise IT leaders due to its approach in targeting gamers through social engineering tactics.

Key Findings

The malware disguises itself as the 'Nursultan Client', mimicking a legitimate Minecraft software to deceive users. Despite being Windows-specific for some functions, its core C2 framework operates across multiple platforms, including Windows, Linux, and macOS.

Utilizing Telegram for all C2 communications allows for data exfiltration and command execution, emphasizing the need for vigilance in monitoring network activity, especially encrypted channels. The malware can compromise Discord authentication tokens while also performing system surveillance, indicating a multifaceted threat.

Technical Analysis

Payload and Installation

The analyzed sample, created with PyInstaller, attempts to conceal its presence on execution by hiding its console and displaying misleading installation prompts. It inaccurately establishes persistence mechanisms, decreasing its likelihood of surviving system reboots.

Functionality Overview

The use of hardcoded Telegram credentials helps ensure that commands are restricted to authorized users. Key functions include stealing Discord tokens and gathering system profiles, which are sent back to the attacker through Telegram.

Additionally, commands allow for live surveillance through screenshots and webcam access, along with adware functionalities that can display unsolicited content to users.

Conclusion

This analysis emphasizes the need for organizations to maintain visibility of network communications, particularly those conducted via platforms like Telegram. Despite being equipped with numerous capabilities, the malware displays typical traits of a less experienced threat actor due to certain implementation errors.

Detection Capabilities

Netskope's threat protection services offer coverage against the identified threat, reinforcing the necessity for continuous monitoring and proactive defenses.

Additional Resources

Indicators of Compromise (IOC) related to this malware can be accessed in the provided GitHub repository.

Blog post, originally published by Nikhil Hegde at netskope.com.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/netskope-identifies-a-new-python-rat-targeting-gamers-through-telegram/",
        "name": "Netskope identifies a new Python RAT targeting gamers through Telegram",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/netskope-identifies-a-new-python-rat-targeting-gamers-through-telegram/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/netskope/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
      "name": "Netskope"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
      "@type": "Person",
      "name": "Decision Insights Coverage",
      "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
    },
    "dateModified": "2026-08-23T15:03:17-06:00",
    "datePublished": "2025-11-11T12:11:08-07:00",
    "description": "Netskope identifies a new Python RAT exploiting Telegram for C2 functions, targeting gamers with social engineering tactics.",
    "headline": "Netskope identifies a new Python RAT targeting gamers through Telegram",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Nikhil Hegde"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      "url": "https://www.netskope.com/blog/new-python-rat-targets-gamers-via-minecraft"
    },
    "keywords": [
      "Indicators of Compromise",
      "Malware",
      "Monitoring",
      "Python",
      "Threats",
      "Tokens"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/netskope-identifies-a-new-python-rat-targeting-gamers-through-telegram/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/microsoft/github/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/microsoft/github/",
        "name": "GitHub"
      },
      {
        "@id": "https://decisioninsights.ai/registry/netskope/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/netskope/",
        "name": "Netskope"
      },
      {
        "@id": "https://decisioninsights.ai/projects/python/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/python/",
        "name": "Python"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-coverage/#person",
    "@type": "Person",
    "description": "Blog posts, podcasts, and video analysis from across the industry, condensed into short, sourced summaries. Produced under our Standards & Methodology.",
    "name": "Decision Insights Coverage",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-coverage/"
  }
]

Is this your company? Get structured data for your own pages