- Cybercriminals are running away from the usual dark web forums because law enforcement crackdowns and takedowns have continued to be aggressive.
- The hub for bad actors has moved to Telegram channels and private groups that they can easily create.
- Hackers now sell their stolen goods, malware tools, corporate credentials, ransomware services, and database leaks on Telegram using automated bots to do everything from handling payments, verifying buyers, and delivering the stolen illicit goods.
- This shift is making cyberattacks more successful for them and complicating the work of law enforcement agents because Telegram’s mainstream infrastructure makes it easy for criminal networks to rebuild quickly after the government bans them.
Telegram is quickly becoming a central hub where cybercriminal activity is raging globally because the well-known dark web forums are on the decline due to continuous law enforcement actions.
Security researchers have shared reports showing that hackers, brokers of data, and ransomware groups are now using more of the encrypted messaging platform to share information about their illicit goods.
Some of these goods they advertise and sell include tools for coordinating attacks, credentials stolen from people, access to corporate networks, etc.
Usually hidden marketplaces need special tools before anyone can access them. But Telegram is sitting on the main internet everyone uses. That’s why criminals can rebuild a community very fast, even if the platform operators ban them.
According to expert reports, this move into Telegram on the open internet is very dicey indeed because it will increase attack timelines and make the work of investigators and enterprise security very hard.
Telegram is Replacing Traditional Dark Web Forums
For years, cybercriminals were solely operating on hidden dark web forums, which could only be accessed through the popular Tor browser. These platforms made use of escrow systems to complete transactions where a buyer keeps money in the platform’s account until they receive the goods, before allowing the release of the payment.
There were also the reputation scores that enabled buyers to know vendors to buy from, and the membership of these platforms wasn’t open to all at all making it easier for buyers and sellers to trust one another.
Even though the platforms operated in an organized manner, there was still a major weakness: when the authorities grab their servers, the whole criminal community would vanish overnight.
Now, with Telegram, this vulnerability is now a thing of the past. The platform allows users to easily create their own public channels or private groups in a few minutes. They can even send messages in encrypted formats without wasting any time.
In fact, if one group goes down, another one will replace it immediately, and in some cases, they will easily send their followers to the new group using invite links. Ransomware gangs now make use of Telegram to bring in affiliates, show the data they stole, and tell their victims to pay without fear.
Hacktivist groups like NoName057(16) and Cyber Fattah now use Telegram to announce they carried out a particular attack and spread their fears to a global audience.
Malware developers have joined the trend, using Telegram as their own hub for doing business. They handle things like paid subscriptions, the release of software updates, and provision of customer support on the app.
They are now working like other software-as-a-service (SaaS) companies that are legitimate. It is surely evident that cybercrime has become more organized, no longer hidden, and more difficult to shut down, unlike before.
Telegram is Powering the Sale of Corporate Network Access
One of the terrible things that could happen to businesses under this present narrative is the speed by which Initial Access Brokerage (IAB) activity on Telegram is growing.
IAB simply means when criminals successfully break into corporate systems and turn around to sell that access to their fellow attackers, often ransomware groups.
Dedicated Telegram channels are now inviting people to buy VPN credentials they have stolen from companies, Remote Desktop Protocol (RDP) access, & ways to enter into top cloud platforms like Okta, Microsoft Azure and Amazon Web Services.
It is usually surprising how they detail the listings of these products. These bad actors selling such access even share the annual revenue of the victim company, the sector they operate in, the place they operate from, and even the system privilege a buyer can get. With all this information, a buyer will know if their target is worth the effort or not before buying the access.
They don’t just mention these details; the bad actors even show screenshots, the active directory data, and can sometimes go live to execute the access, showing buyers that what they want to buy will actually work. All that aims to make sure disputes won’t come up after the transaction is complete.
The implication of this detailed listing and selling is that the time that exists between the initial breach and a full-scale attack becomes very short. In some cases, the buyers can get access and, within hours, enter the victim’s company and do their worst, leaving the victim no time to discover and prevent such attacks.
Automation on Telegram is Speeding Up Cybercrime
Telegram is not just supporting criminal conversations; it has even made transactions simpler and faster with its Built-in bots. These bots now do all those things that people needed to do manually on the dark web forums regarding negotiations.
These bots can now easily verify stolen credentials, confirm that cryptocurrency payments have become successful, and even deliver the data to the buyer. They can even manage subscription-based tools for hacking. What people took days to handle before on the dark web now takes place instantly.
This automation extends to phishing campaigns as well, including scams that exploit supply chain fears by sending automated “out-of-stock” alerts that lead victims to credential-harvesting pages, all managed through Telegram bots.
This speed is making the cybercrime lifecycle to be shorter indeed. When criminals sell access to a company’s systems very fast, the buyer can get to work immediately, deploying ransomware and stealing data without wasting time.
This speed reduces the window in which the security team has to identify that something unusual is happening and a threat is imminent. For businesses, this means that monitoring marketplaces operating on Tor like before is no longer the only necessary thing to do. Security strategies must now work based on what is happening right now.
On that note, experts recommend more defensive measures like using a multi-factor authentication VPN, RDP and cloud accounts that are capable of resisting phishing attempts. Businesses must make sure that RDP services are never shown on the public internet and also that all remote access policies are stringent without room for careless trusts on people.
Apart from all that, businesses should monitor every login activity that comes from suspicious IP addresses or from locations that appear unusual. Further, the threat intelligence programs should cover more areas, including tracking of those channels on Telegram that post ads of Corporate access.
Moreover, auditing credentials regularly, removing accounts that are not active, and strict privilege management will help businesses reduce their exposure to cybercriminals.
