Goodbye, dark Telegram: Blocks are pushing the underground out

This research analyzes Telegram’s role in cybercriminal operations, noting its lack of default E2E encryption, centralized and closed infrastructure, and how these factors shape underground use; based on 800 blocked channels from 2021–2024, it finds the median lifespan of illicit channels rose from five to nine months, blocking activity has increased since October 2024, and frequent takedowns are pushing actors to alternate messaging platforms, with further details available via Kaspersky Digital Footprint Intelligence.