Cybercriminal activity on Telegram has surged, with a 53% increase in illicit posts from May to June 2024, driven by the platform’s popularity and perceived security. Kaspersky Digital Footprint Intelligence offers a playbook to help enterprises manage these risks.
2 July 2024 – The Kaspersky Digital Footprint Intelligence team has identified a worrying trend of increased cybercriminal activity on Telegram, as shadow channels on the platform are increasingly used for illicit activities. According to the team’s findings, the volume of posts discussing fraud schemes, distributing leaked databases, and trading various criminal services surged by 53% in May-June 2024 compared to the same period last year.
Alexey Bannikov, an analyst at Kaspersky Digital Footprint Intelligence, attributes the growing interest of cybercriminals in Telegram to several factors. Telegram’s popularity, with 900 million monthly users as reported by Pavel Durov, its marketing as a secure and independent messenger that does not collect user data, and the ease of creating and finding communities, all contribute to its attractiveness for cybercriminal activities.
Bannikov notes that cybercriminals on Telegram generally lack the technical sophistication seen on more specialized dark web forums. The low barrier to entry means that individuals with malicious intent only need to create an account and subscribe to criminal sources. Additionally, the absence of a reputation system, which is a common feature on dark web forums, leads to a high prevalence of scams within Telegram’s cybercriminal space.
Telegram is also becoming a favored platform for hacktivists, who use it to make statements, incite DDoS attacks, and publicly release stolen data from targeted organizations. The platform’s extensive user base and rapid content distribution capabilities make it an effective tool for these disruptive activities.
In response to these findings, Kaspersky Digital Footprint Intelligence has released a comprehensive playbook designed to help enterprises track shadow market activities and handle data-related incidents, aiming to mitigate the associated cyber risks.
