As social media sites crack down on what they deem as misinformation, users have flocked to a new ‘free speech’ platform: Telegram.
Last year, total downloads for the instant messaging app topped 1.0 billion worldwide. And today, more than 900 million people use the service each month.
And for good reason.
Prized for its privacy features, Telegram once attracted an eclectic mix of criminals, terrorists, political dissidents, hate groups, and internet malcontents. Though in recent years, the site has gone mainstream.
Which raises the question, should security teams start paying attention to this platform? And if so, what are the best tools and techniques to conduct OSINT on Telegram?
Let’s dive in.
Dubai-based Telegram, an alt-tech instant messaging app co-founded by exiled Russian billionaire brothers Pavel and Nikolai Durov, closely resembles WhatsApp and Facebook Messenger.
You can send files, create group conversations, and message other users. And after a long wait, developers introduced a group video calling function similar to Zoom.
What distinguishes Telegram from other apps, however, comes down to the service’s extensive privacy features.
Users can enable end-to-end encryption by activating Secret Chat mode. This function prevents anyone outside of a two-way conversation — be it a government, a company, hackers, or others — from reading your messages.
Moreover, Telegram doesn't track or profile users for advertising. Instead, the app displays sponsored content only on public channels based on the topic of discussion.
This approach allows Telegram to preserve user privacy while still serving up reasonably precise ads.
"[...] no user data is mined or analyzed to display ads, and every user viewing a particular channel on Telegram sees the same sponsored messages," the company explains on its website.
"We believe that everyone has the right to privacy, and technological platforms should respect that."
Such a commitment to privacy has turned Telegram into a key tool for pro-democracy activists. Protestors have used the app to subvert repressive regimes in countries like Iran, Belarus, Thailand, and Hong Kong.
More recently, Telegram has emerged as the go-to app for news following Russia's invasion of Ukraine. The site serves as a valuable resource for both refugees escaping the crisis and increasingly Russians looking for alternative news sources.
And in the days following the attack on his country, Ukrainian president, Volodymyr Zelensky, used Telegram to publish a video message calling on his fellow citizens to resist the Russian assault.
Group Chats also represent a popular feature.
Rival messaging services typically limit the size of these groups to a few hundred members. But on Telegram, any user can create a gathering, called Channels, with hundreds of thousands of participants.
This capacity allows channels to serve as a hub for a community or a one-way news source on a topic of interest. Subjects range from movies and video games to politics and cryptocurrencies.
Most cities and countries have a dedicated Telegram channel – which can represent an outstanding source for news and commentary around local events.
Unfortunately, Telegram’s commitment to privacy has turned the site into a hub for criminal activity that now rivals the dark web.
That has occurred for a few reasons.
For starters, accessing and safely navigating the dark web requires a high degree of technical sophistication. And rival groups can knock any site offline with a simple distributed denial of service (DDoS) attack.
By comparison, users can download the Telegram app straight from the Google or Apple App stores. That allows people, who may not have been able to access such content previously, to stumble into the online criminal underworld.
Operating on Telegram has many advantages for experienced criminals, too.
Outfits can set up an online marketplace with a few clicks of the mouse – no need to invest in a swath of expensive servers. For most products or services, sellers can access a much larger pool of buyers.
And because such communities exploit Telegram’s infrastructure, organizers don’t have to worry about DDoS attacks or other disruptions.
In terms of the type of products for sale in these underground marketplaces, researchers at Norton LifeLock reported criminals selling a wide variety of illegal goods.
Popular products included stolen gift cards, fake documents, bank account credentials, pharmaceutical drugs, hacking tools, stolen passports, and pirated software.
Counterfeit goods represented especially hot sellers on Telegram. Researchers discovered hundreds of accounts and groups selling knock-off products, including purses, electronics, luxury watches, and designer clothes.
Furthermore, Telegram’s limited moderation policies have turned the site into a haven for extremists and hate groups.
Users from these communities exploit the platform to dox targets, spread propaganda, publish disinformation, recruit new members, and network with peers.
To start conducting OSINT on Telegram, you will need to set up an account.
Keep in mind that while the app has a reputation for privacy, missteps can reveal your identity to on-lookers.
So if your research takes you to some of the dodgier sections of the site, it makes sense to take extra precautions during the sign-up process.
For example:
Telegram’s intuitive interface makes the app easy to use and navigate. Still, it's sometimes hard to uncover relevant groups and channels.
To overcome this issue, we’ve highlighted a handful of OSINT tools and techniques that can be helpful when conducting investigations.
Telegram’s raw size in and of itself makes it a valuable resource. And as other social networks keep cracking down on abusive practices, we expect the app’s influence will only grow from here.
For researchers and analysts, that should make Telegram a go-to place for gathering open source intelligence.