A new study has shed light on the world of Telegram’s darknet groups, showing Russian is the most dominant language across these groups on the popular messaging app, followed by English. Where one marketplace collapses, Telegram facilitates dozens of replacements, each with lower visibility and faster growth curves. BidenCash, a dark web market, operates an automated monitoring system that scans Telegram, Discord, and hacker forums for stolen card data. In addition to its main log-sharing function, Observer Cloud provides custom-built programs, a scam list, and chat groups for discussions and transactions related to logs. The community continues to expand, aiming to strengthen its presence in the underground cyber ecosystem.
Why Is Telegram So Popular?
Users ask questions to clarify how to use specific software or resolve issues, much like in Credential Compromise channels. This reflects a need for guidance to effectively use pirated software and troubleshoot any problems that arise. The battle against piracy and the protection of copyright have become pivotal issues in the digital era. On one hand, digital technologies have enabled widespread copyright infringement; on the other, they have facilitated the proliferation of new creative works on a massive scale (Aguiar et al., 2024; Waldfogel, 2017; Wu and Zhu, 2022).
Illicit Telegram Channels and Stolen Credentials have become significant concerns in the world of cybersecurity. Illicit Telegram channels refer to private groups or channels on the popular messaging app Telegram that are operated by threat actors and cybercriminals. These channels serve as underground marketplaces for various illegal activities, including the distribution of stolen credentials. In Blackhat Resources channels, users frequently ask for help with tool functionalities or seek advice on specific hacking techniques. ” and requests for tool enhancements show that users value ease of access and improved functionalities.

From Boom To Ban: The Rise And Fall Of India’s Betting Apps
While takedowns rarely eliminate operations, they force constant churn and reduce the longevity of large-scale hubs. For defenders, monitoring communication platforms has become as important as tracking marketplaces themselves. Instead of disappearing, Hydra’s network simply adapted to a new medium, underscoring the difficulty of suppressing illicit commerce with infrastructure takedowns alone.
Thirsty Data Centres Boom In Drought-hit Mexico
It uses encryption to provide anonymity to users, their activities, and hosted websites. While some may consider the dark web and the deep web to be synonyms, the deep web is actually a much broader web class that makes up the majority of the internet, yet isn’t public-facing (for example, found on most search websites) or indexed. The Darknet Telegram Directory is a curated list of links to various darknet channels and groups available on the Telegram platform. The directory provides a comprehensive collection of darknet-related information and resources for those interested in exploring the hidden aspects of the internet.
Should You Pay Ransom After A Cyberattack? What You Need To Know
- For instance, 7.2% of the posts offered insights into email spamming techniques, promoting tools like SMTP settings, and cracked email marketing software to facilitate unauthorized mass email campaigns.
- Stolen login credentials, on the other hand, grant threat actors unauthorised access to various accounts, which they can exploit for financial gain or even identity theft.
- Through this proactive surveillance, organizations can protect their data, reduce exposure, and strengthen their defense against cybercrime.
- Newsweek contacted Telegram for comment via the platform’s official press team channel.
- This makes them more accessible than dark web forums, and as a result, these groups have become popular with cybercriminals who are looking for an easy way to communicate with each other and find potential collaborators in criminal activities.
- Governments and lawmakers continue to grapple with the challenge of balancing copyright protection with maintaining the internet as a platform for free expression and cultural diversity (Jacques et al., 2018; Kettemann and Benedek, 2019).
However, once they are accepted, these users can trade and purchase illicit drugs, including cocaine, MDMA, and methamphetamines. Even if you don’t get in trouble with the law, paying for substances via a credit card or bank transfer could bite you in the backside if a group member doesn’t deliver your goods or uses your details to commit fraud. To receive notifications about new content, users on Telegram must follow (join) a specific channel. We tracked the growth of followers across all CACs in our database over the study period, yielding insights into their growth patterns. Collectively, the identified CACs are followed by approximately 23.8 million users, with a median of 8,000 followers per channel.
Detection Vectors And Law Enforcement Response

The tension between user privacy and operational transparency underscores the complexity of balancing security and privacy in the digital age. To mitigate these risks, Dark Web monitoring has become a critical cybersecurity strategy. It allows organizations to detect breaches, identify threats, and anticipate attacks before they cause real damage. Currently, the channel claims to have a database of over 2 billion records available via a subscription-based model, making it one of the most active sources for buying and selling stolen credentials. Since its creation in 2019, vx-underground has gained recognition for hosting one of the largest online malware repositories. Its activity isn’t limited to Telegram—they also operate on Twitter and their official website, where they share information about new security breaches, malware trends, and verified threat reports.
🖤BlackAnime Telegram Channel

Telegram’s reluctance to provide user data and its limited response to legal requests complicate efforts to address illegal activities effectively5. This lack of cooperation reflects a broader tension between maintaining user privacy and addressing the misuse of digital platforms. The platform’s opacity in its dealings with authorities hinders effective regulation and enforcement, complicating efforts to curb illegal activities.

What Financial Data Is Sold On Dark Web Marketplaces?
The collapse of Hydra Market in 2022, once responsible for over 80 percent of darknet market traffic and more than $5 billion in lifetime turnover, created a vacuum. When law enforcement seized Hydra’s servers, displaced vendors and customers turned to Telegram. Within weeks, Hydra-branded channels appeared offering drugs, stolen data, and counterfeit documents. Researchers tracking these groups noted that Telegram’s broadcast and bot features allowed operators to recreate the functionality of darknet forums almost overnight.
Illicit Telegram Communities: The Direct To Consumer Model

In recent years, Telegram has become a popular messaging platform for both illicit and legitimate communication activities. The app has allowed people from all over the world to be able to share and collaborate more than ever before. However, it has also allowed numerous dark web forums and other nefarious groups to move onto the messaging app as well and create illicit channels successfully. More recently, there has been a spike in illicit activities moving into online messaging applications like Telegram. Combined these two facets of cyberspace host a plethora of criminal activities carried out by threat actors.
Newsweek contacted Telegram for comment via the platform’s official press team channel. Dark Storm Team is a hacktivist threat group known for its pro-Palestinian cyber activities and past collaborations with groups such as Anonymous Sudan. The group has carried out cyberattacks against Denmark, Egypt, France, Israel, the UAE, and the United States, frequently working alongside other threat actors.

This makes them more accessible than dark web forums, and as a result, these groups have become popular with cybercriminals who are looking for an easy way to communicate with each other and find potential collaborators in criminal activities. The advantage of these groups over dark web forums is that they offer users an extra layer of anonymity, making it harder for law enforcement or researchers to uncover their identities. As cybercriminals continue to exploit dark web markets, Telegram channels, and underground forums, organizations must take a proactive approach to identifying potential risks.