Modern messaging platforms such as WhatsApp, Telegram, and Signal are frequently exploited for illicit activities. Kaspersky Digital Footprint Intelligence conducted extensive monitoring of over 800 blocked Telegram cybercriminal channels between 2021 and 2024. While illegal activities persist on the platform, the environment has become increasingly difficult for sustained underground operations.
Telegram’s Low-Effort Ecosystem for Cybercrime
Telegram’s built-in bot framework and features create a convenient ecosystem for cybercriminals. Single bots can simultaneously handle user queries, process cryptocurrency payments, and deliver stolen bank cards, phishing kits, info-stealer logs, or DDoS attack tools to hundreds of buyers daily, often without manual operator involvement.
Unlimited, non-expiring file storage further simplifies distribution of multi-gigabyte data dumps or stolen corporate documents without requiring external hosting. This automation naturally favors high-volume, low-price, low-skill offerings such as leaked bank cards or malware hosting. Meanwhile, high-value, reputation-dependent transactions, like zero-day vulnerability information, continue to take place on gated dark-web forums.
Trends Observed in Illegal Telegram Activity
Kaspersky researchers identified two key trends on Telegram:
-
Increased channel longevity: The proportion of shadow channels surviving more than nine months more than tripled in 2023–2024 compared to 2021–2022.
-
Rising blocking activity: Monthly takedowns recorded since October 2024 – even at their lowest – match the peak levels seen throughout 2023, and the pace of enforcement continues to accelerate in 2025, impeding malicious operations.
Additional challenges for cybercriminals on Telegram include the lack of default end-to-end encryption for chats, reliance on centralized servers, and closed server-side code, preventing verification of platform functionality.
Shifts in Underground Communities
Several established cybercriminal communities, including the 9,000-member BFRepo group and the Angel Drainer malware-as-a-service operation, have begun migrating activities to alternative platforms or proprietary messengers. They cite repeated service disruptions and blocks on Telegram as the main reason.
“Fraudsters find Telegram a convenient tool for many malicious activities, but the risk-reward balance is clearly shifting,” says Vladislav Belousov, Digital Footprint Analyst at Kaspersky. “Channels now survive longer than a couple of years ago, yet the dramatically higher volume of blocks means operators cannot rely on long-term stability. When a service disappears overnight – and sometimes reappears only to be blocked again weeks later – building a reliable business becomes much harder. Early stages of migration are already visible as a direct consequence.”
Kaspersky Recommendations
To help users and organizations stay protected, Kaspersky recommends:
-
Reporting clearly illicit channels and bots to accelerate community-driven moderation.
-
Using multiple Threat Intelligence sources (covering surface, deep, and dark web resources) to stay informed about underground activities and actual TTPs employed by threat actors.
By following these measures, organizations can mitigate risks associated with cybercriminal activity on messaging platforms and maintain stronger digital security.
