Telegram is a popular messaging platform focused on privacy, offering end-to-end encrypted communication to over 550 million users worldwide. Bolster AI’s dark web threat intelligence research shows how its channels have become hubs for cybercrime.
On the surface, it looks like just another messaging app, but a closer look reveals a thriving underground marketplace for cybercrime.
What makes Telegram an ideal place for criminals
Unlike WhatsApp and Signal, Telegram allows users to hide their phone numbers from other users and communicate through use of just usernames.
It’s easier to set up channels, group chat rooms, and secret chats on Telegram instead of setting up a dark web market which requires setting up servers, website administration, and attracts a ton of scrutiny from law enforcement agencies.
Request a Demo: See how Bolster stops scams in real-time.
A wide user base of 550 million users allows criminals to attract more customers to their illicit Telegram channels and group chats.
Telegram has a low barrier to access. To access hidden onion network sites users need to install the Tor browser and need to be somewhat tech savvy, but Telegram is just another app on the app store.
Lack of strict moderation in place makes Telegram an ideal place for cybercrime.
Types of cyberthreats on Telegram
Cybercriminals routinely use Telegram to sell and share stolen financial information, compromised bank accounts, credentials, fake identification documents, and hijacked streaming accounts.
In this analysis, Bolster AI’s threat intelligence team looks at what cybercriminals offer across various Telegram channels.
Financial fraud and Telegram scams
Sellers on Telegram offer a wide variety of data when it comes to financial fraud.
There are plenty of sellers offering Telegram carding (both physical and digital), stolen bank account credentials, hijacked accounts, or pre-KYC verified crypto exchange accounts. Different Telegram channels offer different services.
Data breaches
Leaked corporate files and stolen databases that surface on dark web forums often move quickly to Telegram. Cybercriminals share these records for free or sell them, sometimes bundled with password-cracking tools and ready-made phishing kits.
Hijacked accounts and stolen credentials
Hijacked accounts for streaming services, consumer VPNs, and other platforms, from Amazon Prime, Netflix, HBO, and Spotify to NordVPN and ExpressVPN, are posted for free or sold cheaply on Telegram.
Criminals usually take over these accounts by reusing email and password combinations leaked in data breaches (a technique called credential stuffing), then sell them in bulk or hand them out for free.
Fake IDs, documents, and vaccination certificates
Increased public scrutiny forced the platform to adjust moderation enforcement against illicit document distribution, though enforcement remains inconsistent.
Despite moderation, threat actors continuously issue forged records, government documents, and forged vaccination certificates.
High-quality altered driver’s licenses, passports, and identity documents containing stolen identifiable information are widely available across underground market channels.
Tutorials, malware tools, and bragging
Channels host technical tutorials, operational manuals, and malware, and cybercriminals share their methods for free or as a service.
Showcasing illicit profits in public channels also acts as a recruitment tool, drawing novice criminals into these operations.
Taking down illegal channels and monitoring for threats
Content posted in Telegram channels isn’t moderated strictly, and a lot of illegal channels and group chats fly under the radar. In 2021, Telegram said in a statement that it has an “ever growing force of professional moderators” removing 10,000 public communities every day for violating its TOS.
Platform moderation alone won’t protect a specific brand, so security teams need their own continuous monitoring to find and remove threats that target their organization.
Threat networks keep backup channels ready so they can resume operations quickly if a primary group is removed, which means monitoring has to follow them when they move.
Much of this activity has shifted to real-time chat platforms, with traditional forums used mainly for advertising. Bolster AI’s dark web monitoring surfaces exposed credentials, leaked data, and brand mentions across dark web forums, marketplaces, and Telegram, with analyst validation before anything reaches your team.
About Us
Thank you for reading this blog! This blog is published by Bolster Research Labs. We are also creators of https://checkphish.ai – a free URL scanner to detect phishing and scams sites in real time.
If you are interested in advanced research and uncovering of new scams or working with cutting edge AI, come work with us at the Bolster Research Labs. Check out open positions here
References
- Telegram emerges as new dark web for cyber criminals | Ars Technica
- Cybercrime is moving from the dark web to Telegram more and more, study finds – Tech (mashable.com)
- Is Telegram becoming the new alternative to the Dark Web? | TechRadar
- Telegram is a hotspot for the sale of stolen financial accounts (bleepingcomputer.com)
- Telegram has seen a sharp rise in cybercriminal activities, report says | Engadget
