Recent data indicates that Telegram cybercriminal channel blocks are accelerating at an unprecedented pace, forcing illicit actors to abandon the platform in favor of private alternatives. While modern messengers are frequently exploited for illegal activities, the environment for sustained underground operations has become significantly more challenging.
The Context: A Frictionless Ecosystem
For years, Telegram has been a favored hub for the digital underworld due to its robust bot framework and unlimited file storage. A single automated bot can manage cryptocurrency payments and deliver stolen data—such as bank cards or phishing kits—to hundreds of buyers daily without manual intervention. This ease of use has traditionally supported high-volume, low-skill offerings.
The Evidence: Trends in Takedowns
Kaspersky Digital Footprint Intelligence, which monitored over 800 blocked channels between 2021 and 2024, identified two conflicting trends:
- Increased Lifespans: The proportion of shadow channels surviving over nine months more than tripled in the 2023-2024 period.
- Aggressive Moderation: Despite longer lifespans for some, the overall volume of Telegram takedowns has surged since late 2024.
Monthly figures recorded in 2025 have already reached levels comparable to the peak periods of 2023, suggesting that platform moderation is becoming more effective at impeding malicious activity.
The Verdict: Shifting Risks
The lack of default end-to-end encryption and the centralized infrastructure of the app are increasingly seen as liabilities by professional fraudsters. High-profile groups like BFRepo and the Angel Drainer malware-as-a-service operation have already begun migrating to proprietary messengers or dark-web forums.
“The risk-reward balance is clearly shifting,” says Vladislav Belousov, Digital Footprint Analyst at Kaspersky. “When a storefront disappears overnight and reappears only to be removed again weeks later, building a reliable business becomes much harder”.
To stay protected, organizations should utilize Threat Intelligence services and report illicit bots to accelerate community moderation.
