---
title: Telegram Zero-Day Used to Mine Crypto
description: Kaspersky Labs revealed today that a previously-unknown attack on the popular messaging app Telegram infects users’ devices with cryptocurrency mining malware. Research indicates that Russian cybercriminals have used this exploit since March 2017 to mine Monero, Zcash, and Fantomcoin. What We Know about the Telegram Zero-Day According to Kaspersky research Alexey Firsh, Telegram doesn’t handle […]
---

[Skip to content](https://blog.scsprotect.com/telegram-zero-day-used-to-mine-crypto#main-content)

[![SCS Logo](https://blog.scsprotect.com/hs-fs/hubfs/logo-1-300x92.png?width=300&height=92&name=logo-1-300x92.png "SCS Logo")](https://scsprotect.com/)

[708-593-3516](tel:708-593-3516)

Search

- There are no suggestions because the search field is empty.

- [Cyberthreats](https://scsprotect.com/cyberthreats/)
- [Services](https://scsprotect.com/services/)
  
  Show submenu for Services 
  
    - [Overview](https://scsprotect.com/services/)
    - [Cybersecurity Engagements](https://scsprotect.com/services/cybersecurity-engagements/)
    - [Governance & Compliance](https://scsprotect.com/services/governance-and-compliance/)
    - [Managed Security](https://scsprotect.com/services/managed-security/)
    - [IT Support](https://scsprotect.com/services/it-support/)
- [Partners](https://scsprotect.com/partners/)
- [About](https://scsprotect.com/about/)
- [Contact](https://scsprotect.com/contact/)
- [Blog](https://blog.scsprotect.com)

- [Cyberthreats](https://scsprotect.com/cyberthreats/)
- [Services](https://scsprotect.com/services/)
  
  Show submenu for Services 
  
    - [Overview](https://scsprotect.com/services/)
    - [Cybersecurity Engagements](https://scsprotect.com/services/cybersecurity-engagements/)
    - [Governance & Compliance](https://scsprotect.com/services/governance-and-compliance/)
    - [Managed Security](https://scsprotect.com/services/managed-security/)
    - [IT Support](https://scsprotect.com/services/it-support/)
- [Partners](https://scsprotect.com/partners/)
- [About](https://scsprotect.com/about/)
- [Contact](https://scsprotect.com/contact/)
- [Blog](https://blog.scsprotect.com)

## Telegram Zero-Day Used to Mine Crypto

[by Admin](https://blog.scsprotect.com/author/admin)  February 13, 2018

Kaspersky Labs revealed today that a previously-unknown attack on the popular messaging app Telegram infects users’ devices with cryptocurrency mining malware. Research indicates that Russian cybercriminals have used this exploit since March 2017 to mine Monero, Zcash, and Fantomcoin.

###### **What We Know about the Telegram Zero-Day**

According to Kaspersky research Alexey Firsh, Telegram doesn’t handle the Unicode Right-To-Left Override (U+2020E) character correctly. Developers use this character to indicate that text must be read right-to-left, such as for Hebrew and Arabic. By hiding this character in a filename, attackers can force the app to reverse text and thereby rename files.

An example of this attack involved spammers sending links to the file “photo\_high\_re\*U+202E\*gnp.js”. When Telegram attempts to display the name to the recipient, it will reverse all letters coming after the RTL character. This yields the filename “photo\_high\_resj.png”, thereby masking the Javascript file as a PNG image. When a user attempts to view the image, they actually run the JS file, which infects their device.

Most attacks carried out with this exploit infected devices with cryptocurrency mining malware. As we mentioned in [our Monero article](http://dev.securecompliance.co/?p=456), cryptocurrencies like Monero, Zcash, and Fantomcoin have inherent identity-masking features, which allow for attackers to easily abscond with funds. Other attacks include the installation of Trojans controllable with Telegram’s API and the theft of user data.

No one knows how much the attackers have collected so far, but Kaspersky indicates that Telegram has patched the vulnerability sometime after disclosure in October 2017.

###### **More Reading**

- [Bleeping Computer article](https://www.bleepingcomputer.com/news/security/telegram-0-day-used-to-spread-monero-and-zcash-mining-malware/)
- [Bloomberg article](https://www.bloomberg.com/news/articles/2018-02-13/kaspersky-says-telegram-flaw-used-for-cryptocurrency-mining)
- [ZDnet article](https://www.zdnet.com/article/telegram-zero-day-let-hackers-spread-backdoor-and-cryptocurrency-mining-malware/)

*Secure Compliance Solutions is the trusted security advisor for Chicagoland’s small-to-medium businesses. We offer a variety of services that promote a strengthened security posture and a culture of compliance. Our solutions include: risk advisory services, strategic cybersecurity planning, security and privacy awareness, regulatory guidance, penetration testing, and managed security services. We tailor our engagements and solutions to align with your cultural needs and business objectives; not the other way around. We keep your appetite for risk, budget constraints, and timeline in mind to define strategy and operational tactics that maximize your return on investment. At SCS, we help you navigate the course of your cybersecurity journey.*

This is a search field with an auto-suggest feature attached.

- There are no suggestions because the search field is empty.

### Recent Posts

### Categories

[Data Breaches, Hacks, and Thefts](https://blog.scsprotect.com/tag/data-breaches-hacks-and-thefts) [Cryptocurrency](https://blog.scsprotect.com/tag/cryptocurrency) [Cyber Attacks](https://blog.scsprotect.com/tag/cyber-attacks)

### Posts by Month

- [October 2025 (1)](https://blog.scsprotect.com/archive/2025/10)
- [June 2025 (2)](https://blog.scsprotect.com/archive/2025/06)
- [April 2025 (2)](https://blog.scsprotect.com/archive/2025/04)
- [March 2025 (1)](https://blog.scsprotect.com/archive/2025/03)
- [February 2025 (1)](https://blog.scsprotect.com/archive/2025/02)
- [January 2025 (1)](https://blog.scsprotect.com/archive/2025/01)
- [November 2024 (1)](https://blog.scsprotect.com/archive/2024/11)
- [October 2024 (1)](https://blog.scsprotect.com/archive/2024/10)
- [August 2024 (1)](https://blog.scsprotect.com/archive/2024/08)
- [June 2024 (1)](https://blog.scsprotect.com/archive/2024/06)
- [April 2024 (2)](https://blog.scsprotect.com/archive/2024/04)
- [February 2024 (1)](https://blog.scsprotect.com/archive/2024/02)
- [October 2023 (1)](https://blog.scsprotect.com/archive/2023/10)
- [February 2023 (1)](https://blog.scsprotect.com/archive/2023/02)
- [November 2021 (2)](https://blog.scsprotect.com/archive/2021/11)
- [October 2021 (1)](https://blog.scsprotect.com/archive/2021/10)
- [December 2020 (2)](https://blog.scsprotect.com/archive/2020/12)
- [November 2020 (2)](https://blog.scsprotect.com/archive/2020/11)
- [October 2020 (4)](https://blog.scsprotect.com/archive/2020/10)
- [September 2020 (1)](https://blog.scsprotect.com/archive/2020/09)
- [August 2020 (1)](https://blog.scsprotect.com/archive/2020/08)
- [July 2020 (1)](https://blog.scsprotect.com/archive/2020/07)
- [June 2020 (1)](https://blog.scsprotect.com/archive/2020/06)
- [May 2020 (1)](https://blog.scsprotect.com/archive/2020/05)
- [April 2018 (1)](https://blog.scsprotect.com/archive/2018/04)
- [March 2018 (5)](https://blog.scsprotect.com/archive/2018/03)
- [February 2018 (3)](https://blog.scsprotect.com/archive/2018/02)
- [January 2018 (5)](https://blog.scsprotect.com/archive/2018/01)
- [December 2017 (3)](https://blog.scsprotect.com/archive/2017/12)
- [November 2017 (3)](https://blog.scsprotect.com/archive/2017/11)
- [October 2017 (6)](https://blog.scsprotect.com/archive/2017/10)
- [May 2017 (1)](https://blog.scsprotect.com/archive/2017/05)
- [January 2016 (3)](https://blog.scsprotect.com/archive/2016/01)
- [November 2015 (1)](https://blog.scsprotect.com/archive/2015/11)
- [October 2015 (1)](https://blog.scsprotect.com/archive/2015/10)

see all

## Read On

### [Using Google Street View to Infer Population Demographics](https://blog.scsprotect.com/using-google-street-view-to-infer-population-demographics)

Researchers at Stanford recently published a paper exploring the harvesting of demographic...

### [Bad Rabbit – Yet Another Petya Variant](https://blog.scsprotect.com/bad-rabbit-yet-another-petya-variant)

###### **Bad Rabbit**

The chain of malware attacks isn’t letting up any time soon. Just this past Tuesday,...

### [A Quick Intro to chaiOS](https://blog.scsprotect.com/a-quick-intro-to-chaios)

Sometimes, at SCS we like to make our posts short and sweet. With chaiOS, we have a great time to...

[![SCS Logo](https://blog.scsprotect.com/hs-fs/hubfs/logo-1-300x92.png?width=300&height=92&name=logo-1-300x92.png "SCS Logo")](https://scsprotect.com/)

### © Copyright 2024 SCS

[TERMS & CONDITIONS](https://scsprotect.com/termsandconditions/) [PRIVACY POLICY](https://scsprotect.com/privacypolicy/)

- [Cyberthreats](https://scsprotect.com/cyberthreats/)
- [Services](https://scsprotect.com/services/)
- [Partners](https://scsprotect.com/partners/)
- [About](https://scsprotect.com/about/)
- [Contact](https://scsprotect.com/contact/)
- [Blog](https://blog.scsprotect.com)

[708-593-3516](tel:708-593-3516)

[Follow us on Twitter](https://twitter.com/SecCompSol) [Follow us on Facebook](https://www.facebook.com/SecureComplianceSolutions) [Follow us on Facebook](https://github.com/Secure-Compliance-Solutions-LLC) [Follow us on LinkedIn](https://www.linkedin.com/authwall?trk=bf&trkInfo=AQGwIqLZLJ6-iwAAAYtsHqqYSjD2Uqv1U_cM0b0djtojM7EUQm9GGXH7fhtuHHmmlyWJJmhQ37JCuRdAjRdXPVOl9FdDVKqOwdqHFc24h_-3zZX1baMyqNlXtLKIKEaU_HG3aa4=&original_referer=&sessionRedirect=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fsecure-compliance-solutions-llc%2Fabout%2F)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Admin",
    "url" : "https://blog.scsprotect.com/author/admin"
  },
  "dateModified" : "2023-10-30T17:39:45.890Z",
  "datePublished" : "2018-02-13T18:39:00.000Z",
  "headline" : "Telegram Zero-Day Used to Mine Crypto",
  "mainEntityOfPage" : {
    "@id" : "https://blog.scsprotect.com/telegram-zero-day-used-to-mine-crypto",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.scsprotect.com/hubfs/logo-1-300x92.png"
    },
    "name" : "Secure Compliance Solutions"
  }
}
```