Cybercriminals are increasingly using Telegram channels and groups to discuss fraud schemes, distribute leaked databases, and trade various criminal services, according to Kaspersky’s Digital Footprint Intelligence data. The volume of such posts surged by 53% in May-June 2024 compared to the same period last year.
“The growing interest in Telegram from the cybercriminal community is driven by several key factors. Firstly, this messenger is very popular in general – its audience has reached 900 million monthly users, according to Pavel Durov.
Secondly, it is marketed as the most secure and independent messenger that does not collect any user data, giving threat actors a sense of security and impunity.
Moreover, finding or creating a community on Telegram is relatively easy, which, combined with other factors, allows various channels, including cybercriminal ones, to gather an audience quickly,” said Alexey Bannikov, an analyst at Kaspersky Digital Footprint Intelligence.
Unlike more restricted and specialized dark web forums, Telegram’s low entry barrier means that cybercriminals on this platform generally demonstrate less technical sophistication and expertise.
Anyone with malicious intent can simply create an account and subscribe to criminal sources. Additionally, Telegram lacks a reputation system similar to those found on dark web forums, resulting in many scammers within Telegram’s cybercriminal space who often deceive their fellow community members.
“There is another trend: Telegram has emerged as a platform where various hacktivists make statements and express their views. Due to its extensive user base and rapid content distribution through Telegram channels, hacktivists find the platform a convenient tool to incite DDoS attacks and other disruptive methods against targeted infrastructures.
Additionally, they can release stolen data from attacked organisations into the public domain using shadow channels,” added Bannikov.
To help enterprises mitigate associated cyber risks, Kaspersky Digital Footprint Intelligence has published a free comprehensive playbook to track shadow market activities and handle data-related incidents.
