Cybercrime on Telegram: Markets, C2 and Monitoring

A large share of everyday cybercrime trade, from stolen cards and infostealer logs to phishing kits and DDoS for hire, now happens in Telegram channels and bot shops rather than on dark web forums, and many monitoring programmes still look only at the forums. Telegram matters to defenders in two ways: as a marketplace where your data, credentials and brand may appear, and as infrastructure that malware and threat groups use for command and control and exfiltration. This guide explains how the Telegram underground works, what is sold there, how threat actors use the platform operationally, and how to monitor it legally, safely and usefully. It is for threat intelligence analysts, SOC leads and fraud teams. It goes deeper than the Dark Web Monitoring Guide, which covers monitoring programmes in general, and does not repeat it.

Key takeaways

Telegram is a high-volume, low-price market. Kaspersky's 2025 research describes stolen cards, infostealer logs, phishing kits, DDoS services and database dumps sold through automated bots, while higher-value goods such as zero-day information stay on reputation-gated forums.
Channels are short-lived but persistent. Kaspersky analysed more than 800 blocked channels and found a median lifespan that rose from five months (2021 to 2022) to nine months (2023 to 2024), with blocking increasing since October 2024. Expect brands to reappear under new names.
It is also C2 and exfiltration infrastructure. MITRE ATT&CK records groups including Sandworm Team, MuddyWater (through Small Sieve), APT38 and Contagious Interview using the Telegram Bot API to send commands or receive stolen data.
Most Telegram chats are not end-to-end encrypted. Telegram states that cloud chats use server-client encryption and only secret chats are end-to-end, and that it may disclose IP addresses and phone numbers to authorities under a valid judicial order.
Monitoring needs rules of engagement. Passive collection is the low-risk default; buying data, engaging sellers or scraping at scale raises legal, contractual and safety issues that need counsel and written approval.

Why the underground moved to Telegram

Forums were the traditional cybercrime marketplace: reputation systems, escrow, long threads. Telegram offered different advantages that suit high-volume trade.

Reach: Telegram's FAQ says channels can have an unlimited number of subscribers and groups up to 200,000 members, and public groups can be joined by link. A seller can broadcast to thousands without a forum's vetting.
Anonymity of posts: channel posts are signed with the channel's name, not the author's, which suits storefronts.
Automation: the Bot API lets anyone build bots. Kaspersky describes bots that take queries, accept cryptocurrency payment and deliver cards, logs or kits to many buyers a day with no operator involved.
Low barrier: no Tor browser, no invitation, a mobile app most people already have.

The same research notes limits that keep sophisticated actors on forums or private messengers: Telegram does not use end-to-end encryption by default, its infrastructure is centralised, and its server code is closed. After repeated blocks, Kaspersky reports some communities, such as the BFRepo group with nearly 9,000 members and the Angel Drainer malware-as-a-service operation, moving activity to other platforms or proprietary messengers. Treat Telegram as one layer of a wider ecosystem, not a replacement for forum coverage. See the Cybercrime Ecosystem Guide.

What is traded

Category	Typical offering	Risk to your organisation	Response route
Infostealer logs and combolists	Bundles of browser credentials, cookies and autofill data, often sold by subscription or searched through a bot	Employee, contractor and customer sessions replayed against SSO, VPN and SaaS	Reset, revoke sessions, check device health. See the Infostealer Logs Monitoring and Response Guide
Payment cards	Card data and "fullz" with personal details	Fraud losses and chargebacks for issuers and merchants	Card reissue, fraud rules. See the Card Testing and Carding Attacks Defence Guide
Phishing kits and phishing as a service	Ready-made login page clones of banks, SaaS and delivery firms, sometimes with MFA relay	Credential and session theft against your users and customers	Brand and domain monitoring, phishing-resistant MFA
Database dumps and corporate documents	Leaked customer data, internal files, extortion leaks	Regulatory notification, extortion, follow-on fraud	Validate, scope, notify. See the Ransomware Data Leak Site Listing Playbook
Access for sale	VPN, RDP, cloud console or admin panel access (ATT&CK T1650 Acquire Access)	Ransomware or data theft precursor	Treat as active intrusion. See the Initial Access Brokers Guide
DDoS for hire and hacktivist calls to action	Booter services, target lists	Service outages	DDoS protection and runbooks
Malware and hosting	Stealers, crypters, malware hosting	Capability for low-skill actors	Detection engineering on families seen
Fraud services	SIM swap, account takeover, insider recruitment offers	Account takeover, bribed staff	Help desk controls. See the SIM Swap Fraud Guide

How threat actors use Telegram as infrastructure

Separately from the market, Telegram is legitimate infrastructure that attackers borrow because traffic to it is common and encrypted in transit. The examples below are recorded in MITRE ATT&CK v20.

Use	ATT&CK technique	Examples recorded by ATT&CK
Command and control through the Bot API	T1102.002 Bidirectional Communication	Sandworm Team (G0034) Python backdoor; Small Sieve (S1035), used by MuddyWater (G0069), over HTTPS
Finding the real C2 address from a channel	T1102.001 Dead Drop Resolver; T1102.003 One-Way Communication	Vidar (S9050); Gamaredon Group (G0047)
Exfiltrating stolen data to a bot or chat	T1567 Exfiltration Over Web Service	APT38 (G0082) credentials; Contagious Interview (G1052); InvisibleFerret (S1245) using a bot token; Magic Hound (G0059)
Delivering malware through Telegram messages	T1566.003 Spearphishing via Service	ToddyCat loaders sent as archives through Telegram
Impersonating IT staff	T1598.001 Spearphishing Service	Scattered Spider in campaign C0027 sent Telegram messages impersonating IT personnel
Fake personas and publicity channels	T1585.001 Social Media Accounts	Contagious Interview fake recruiter accounts; Medusa Group (G1051) and Water Galura (G1050, Qilin operators) announcement channels
Stealing Telegram data from victims	T1213.005 Messaging Applications	APT38 collecting Telegram Desktop data; RedLine Stealer (S1240) collecting chat files

The defensive point: if corporate servers or workstations with no business reason to use Telegram are connecting to the Telegram Bot API, investigate. Bot tokens found in malware are also credentials that can sometimes be reported to the platform to disrupt exfiltration. See the Discord and Telegram Bot Tokens Security Guide for securing your own bots.

Where identity fits

Telegram trade is mostly identity trade. Credentials, cookies and session tokens from infostealers, access to admin panels and cloud consoles, and API keys scraped from code are the commodities that move fastest. Two consequences follow.

Machine credentials appear too: stealer logs from developer machines contain cloud keys, CI tokens and SSH keys alongside passwords. A finding that lists only "employee passwords" may hide non-human credentials with broader access. See the Infostealer Logs and Session Token Abuse Guide.
Speed matters more than coverage: automated bot shops sell within hours. Pair monitoring with automated reset and session revocation so a finding becomes a closed credential the same day. See the Leaked Credential Response Playbook.

Monitoring Telegram legally and safely

Rules of engagement

The US Department of Justice's Computer Crime and Intellectual Property Section published guidance (version 1.0, February 2020) on gathering intelligence from illicit online markets. Although written for US federal law and Tor forums, its distinctions apply directly to Telegram.

Passive collection: reading public channels without interacting carries little federal criminal risk in that guidance, though unauthorised access or interception could raise issues.
Interaction: asking general questions is lower risk; active exchanges that help a seller, or that solicit crime, can create aiding or conspiracy exposure.
Buying data: purchasing your own stolen data has rarely been prosecuted but carries practical risks (scams, trojanised files, resale), and paying a sanctioned seller can breach sanctions law even without knowledge.
Personas: pseudonyms are generally lawful; impersonating a real person or a government official is not.
Governance: keep written rules of engagement vetted by counsel, record activities and business purpose, build contacts with law enforcement, and isolate collection from the corporate network.

Outside the US, take local legal advice: data protection law applies to personal data you collect from channels. Platform terms matter too: Telegram's Terms of Service prohibit data scraping under its content licensing and AI scraping terms, so bulk scraping by your own accounts may breach them even where it is lawful. A commercial provider takes on part of that risk, but you should ask how it collects.

Collection options

Approach	Strengths	Weaknesses	Best for
Commercial threat intelligence or dark web monitoring service	Wide channel coverage, historical archives, alerting on your keywords and domains	Cost; opaque collection; coverage claims hard to verify	Most organisations
In-house analyst with sock puppet accounts in isolated environment	Context, judgement, targeted collection	Does not scale; legal and safety overhead; account bans	Large firms with a CTI team
Sector sharing (ISACs, national CERTs)	Validated findings, peer context	Delayed, not specific to you	Everyone, as a supplement
Automated in-house scraping	Control and cost at scale	Likely breaches platform terms; legal review needed; brittle	Rarely justified

Analyst safety

Isolation: use dedicated devices or virtual machines and phone numbers not linked to staff or the company, with no corporate single sign-on.
Files: treat every download as malicious; open it only in a sandbox. Files shared in criminal channels can carry malware aimed at the people who download them.
Exposure: remember that Telegram's privacy policy says it may disclose IP addresses and phone numbers to authorities on valid judicial orders, and group administrators can see who has joined a group; plan personas accordingly.
Welfare: channels can carry abusive or illegal content; set escalation paths and support for analysts.

Triage of a Telegram finding

Preserve: capture the post, channel name, channel link, timestamp and any sample shown, with a screenshot and a hash of any file, before the channel disappears.
Validate without buying: compare sample records with your own systems (do the usernames, card ranges or file names exist?), and check whether the data matches an older, already handled leak.
Classify: credentials and sessions, customer data, access for sale, or impersonation. Each goes to a different owner (identity team, privacy, incident response, brand).
Act within a set time: credentials within hours, access sales immediately as a suspected intrusion, data leaks under your notification process.
Close the loop: record the source, the action and whether the finding was new, so you can measure the provider and your own response.

Rolling out Telegram monitoring

Define intelligence requirements: list what you need to know (your domains, brands, executive names, BIN ranges, product names, code repositories) and who acts on each finding.
Get approvals: agree rules of engagement with legal and privacy teams before any collection, including whether purchases are ever allowed.
Pilot with a provider: run a 60 to 90 day pilot with one or two services, seeded with known past leaks to test coverage and latency.
Wire findings to action: route credential findings to automated reset and session revocation, card findings to fraud, access sales to incident response.
Add network detection: alert on connections to the Telegram Bot API (the api.telegram.org host) from servers and from workstations where Telegram is not approved.
Report abuse: report impersonation channels and bots through the in-app Report option or [email protected] as the FAQ describes, and keep evidence first.
Review quarterly: measure, prune keywords that only produce noise, and add channels that migrated.

Small and large organisations

A small organisation should not run sock puppets. It should buy a credential exposure and brand monitoring service that covers Telegram, enforce phishing-resistant MFA so leaked passwords matter less, and block or alert on Telegram Bot API traffic from servers. A large organisation or financial institution may justify a CTI analyst who follows specific channels, with documented rules of engagement and close ties to fraud and incident response.

Detection and measurement

Network: outbound HTTPS to the Telegram Bot API from servers, build agents and kiosks (DNS logs, secure web gateway, firewall SNI logs).
Endpoint: unexpected processes making Telegram API connections; Telegram Desktop data files read by non-Telegram processes.
Exposure: provider alerts on your domains, executives, card ranges and source code.

Metrics:

Median time from a credential finding to reset and session revocation.
Percentage of findings that led to an action (versus noise).
Number of confirmed exposures first found on Telegram that no other source reported.
Number of hosts making unapproved Bot API connections, trending to zero.
Impersonation channels reported and removed per quarter.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	ID.RA-02; ID.RA-03; DE.CM-01	Receive and record threat intelligence; monitor networks for Bot API use
NIST SP 800-53 Rev. 5	PM-16 Threat Awareness Program; SI-4 System Monitoring; SC-7 Boundary Protection	Threat intelligence programme, monitoring, egress control
ISO/IEC 27001:2022 Annex A	A.5.7 Threat intelligence	Collecting and analysing threat information
MITRE ATT&CK v20	T1102.002, T1102.001, T1567, T1566.003, T1585.001, T1650	Detections for Telegram-based C2, exfiltration and access sales

Common failure patterns

Forum-only coverage: a monitoring contract that covers Tor forums and paste sites but not Telegram misses the high-volume stealer log and card trade.
Findings with no owner: alerts land in a mailbox and the leaked session is still valid a week later.
Analysts on corporate kit: joining channels from a work phone or laptop links the company to the persona and exposes the network to malicious files.
Buying "proof" without approval: an analyst pays a seller to verify a dump, creating sanctions, legal and reputational risk.
Ignoring Telegram on the network: Bot API traffic from servers is treated as normal messaging, so exfiltration through a bot goes unnoticed.
Chasing channel names: blocklists of channel names go stale because channels are banned and reappear; track sellers' goods and patterns instead.

Practitioner checklist

Confirm your monitoring provider covers Telegram channels and bot shops, and test it with a known past leak.
Write rules of engagement covering passive collection, personas, purchases and evidence handling, approved by legal.
Isolate any analyst collection environment from the corporate network and identities.
Route credential findings to automated reset and session revocation, including machine credentials.
Alert on Telegram Bot API connections from servers and unapproved endpoints.
Report impersonation channels and bots to Telegram with preserved evidence.
Track time from finding to remediation as the primary metric.
Review keywords and channel coverage every quarter.

Cybercrime on Telegram Guide: What is traded and how to monitor safely