Many small and mid-sized enterprise (SME) security teams build their threat intelligence planning around surface web feeds, perimeter firewalls, and endpoint protection. All these things are good and necessary. But when darknet risk enters the conversation, it is easy to imagine specialized Tor browsers or complex underground marketplaces that security teams are cut off from.
The darkest corners of the darknet are still accessible with the right software and skill sets. Yet security teams do not necessarily have to dig that deep, thanks to a major shift in cybercrime coordination over the last few years. Believe it or not, threat actors have moved out of hidden Tor forums and into mainstream instant messaging platforms – like Telegram.
Table of Contents
A Primary Hub for Threat Actor Collaboration
Telegram now serves as a primary hub for initial access brokers, database leaks, and cybercrime coordination. That means SME security teams can incorporate Telegram data into their security visibility and fill a critical blind spot. This valuable data often reveals targeted threats long before they trigger security alarms.
Why Cybercriminals Prefer Telegram
DarkOwl is an industry leader in Telegram channel monitoring and OSINT. Clients routinely ask the company why cybercriminals prefer Telegram. It makes little sense to security teams who assume individuals and criminal groups would not want to conduct operations on such an accessible and widely utilized platform.
According to DarkOwl, Telegram offers distinct features that seem ideal for illicit trade:
- Low Entry Barrier – It doesn’t take much to establish a criminal channel on Telegram. You do not need a Tor configuration or PGP key setups. There is little to no vetting process. Essentially, the barrier to entry is quite low.
- Reach and Speed – A single Telegram channel, broadcasting consistently, can reach tens of thousands of subscribers. It is ideal for advertising stolen data dumps and phishing services across a vast digital landscape.
- Feature-Rich Ecosystems – With Telegram, threat actors can utilize integrated file sharing, automated payment bots, closed group chats, and more. They can create their own full-featured commercial environments with very little effort.
Cybercrime teams and individual threat actors can use Telegram as an active digital storefront. They can sell stolen employee login credentials and launch targeted brand impersonation campaigns. The best part of all is that Telegram provides the infrastructure. That means little overhead and only a minor investment on the threat actor’s part.
Investigation Obstacles and How to Overcome Them
SME security teams don’t need massive teams of analysts and huge budgets to gain value from chat platform intelligence. Telegram monitoring yields immediate high-value results – particularly in the areas of exposed employee credentials, brand impersonation and fraud, and initial access markets. But there are hurdles to overcome, the biggest one being platform churn.
While Telegram is rich in threat intelligence, conducting manual Telegram OSINT has its challenges:
- Telegram regularly shuts down illicit channels, which forces threat actors to create new channels and update invite links across their networks.
- The most popular channels generate thousands of chat messages daily. This means plenty of noise for security teams to work through.
- Joining illicit Telegram groups directly from company-owned hardware or personal devices exposes security staff. They need to be careful about their own privacy and security.
The best way to overcome the challenges of Telegram channel monitoring is to deploy an automated platform from a provider like DarkOwl.
Scale Your Intelligence Without Big Spending
A modern intelligence tool capable of ingesting, indexing, and archiving Telegram channels allows SME security teams to scale up their intelligence without excessive spending. Investing in a platform is worthwhile given the increased visibility Telegram monitoring offers.