Modern messaging applications such as WhatsApp, Telegram, Signal and many similar applications are often used by many subjects for illegal purposes. Comprehensive digital risk protection service Kaspersky Digital footprint Intelligence has conducted an in-depth monitoring of more than 800 Telegram channels blocked due to their involvement in cybercrime activities in the period of 2021 - 2024.
Although many illegal activities are still taking place on the Telegram platform, the reality shows that cybercriminals are having increasingly difficulty maintaining "underground" activities.
Researchers at cybersecurity company Kaspersky have discovered two distinct trends in illegal activities on Telegram. First, the average life expectancy of criminal channels is increasing significantly.
The rate of channels existing for more than nine months increased more than three times in the 2023-2024 period compared to the 2021-2022 period. Second, the activity of blocking and removing these channels on Telegram has also increased sharply.
The number of channels processed monthly since October 2024, right at the lowest level, is still equivalent to the peak period in 2023, and processing speed continues to increase in 2025. These measures make the activities of bad guys difficult.
Vladislav Belousov, Digital footprint Analyst at Kaspersky, commented: Circumbers view Telegram as a convenient tool for many illegal activities, but they are also starting to consider the problem between risks and benefits. Currently, many channels may exist longer than a few years ago, but the number of blocked channels has skyrocketed, making it impossible for criminal groups to rely on long-term stability
To help users and organizations minimize the risks from underground activities on Telegram, Kaspersky offers some practical measures:
- Reporting channels and bot that show clear signs of violations, helping to speed up the community censorship process.
- Optimizing diverse information sources from Threat Intelligence (including data from surface web, deep web and darknet) to promptly grasp the latest underground activities and track the tactics, techniques and processes that cybercriminals are using.
