Telegram has been a leader among messengers all over the world for several years. In Russia, it has become not only a means of communication, but also a full-fledged platform through which products, services, ideas and views are promoted.
Hackers also paid attention to this messenger. Many "gray" and frankly illegal sites quite successfully exist inside the platform, promote themselves, talk about their activities and offer their services.
This article will analyze the main reasons for the" relocation " of hacker groups and shadow forums to Telegram, the impact of this process on cybersecurity, and possible consequences for the entire cyberspace.
It is important to note that this audience is very different, from potential victims and accomplices, to "just interested" and potential advertisers. Separately, it is worth highlighting hacktivist projects that have turned into full-fledged channel grids. As an example, we can cite the resources of the Killnet group, which can include a news channel, a channel of the group itself, a channel of its founder, and, with some assumption, several partner channels.
"Corporate" channels have also gained their share of popularity, primarily related to publishing databases, "breaking through" and distributing malicious software for various tasks.
If we talk about the audience of such projects, many of them are driven by simple curiosity and the desire to "touch the forbidden". Most people, even if they have a certain database of leaked data and access to a malware file, are unlikely to become cybercriminals. Not only because they "don't know how", but also because they don't set such goals for themselves.
On the other hand, any conscientious user who believes that hackers and their activities are something far away and "will never touch it" can make sure directly from the search bar of their messenger that hackers are not movie characters, but very real people, whose victim can be any user of the network.
If we talk about moderation of Telegram, then it is certainly not aimed at encouraging hacker activity. This is noticeable, among other things, in the behavior of the hacker communities themselves, which are trying to attract the target audience to "shadow" resources. The methods used are very different, including advertising courses "on working on the Darknet", the content of which can hardly be legal by default.
For cybersecurity specialists, this, on the one hand, promises difficulties, as HPE and information about hacking techniques becomes more accessible. On the other hand, it is much easier to study "public" hackers, which can contribute to the introduction of preventive response practices to certain potential information security problems.
Hackers also paid attention to this messenger. Many "gray" and frankly illegal sites quite successfully exist inside the platform, promote themselves, talk about their activities and offer their services.
This article will analyze the main reasons for the" relocation " of hacker groups and shadow forums to Telegram, the impact of this process on cybersecurity, and possible consequences for the entire cyberspace.
What can Telegram give to "old-timers of the Darknet"?
Messenger is qualitatively different from the darknet platforms in that it has a multiple of the audience. At the same time, the rules for moderation and administration of content in the messenger are quite liberal, and to "earn a ban" you need to be very careless.It is important to note that this audience is very different, from potential victims and accomplices, to "just interested" and potential advertisers. Separately, it is worth highlighting hacktivist projects that have turned into full-fledged channel grids. As an example, we can cite the resources of the Killnet group, which can include a news channel, a channel of the group itself, a channel of its founder, and, with some assumption, several partner channels.
"Corporate" channels have also gained their share of popularity, primarily related to publishing databases, "breaking through" and distributing malicious software for various tasks.
If we talk about the audience of such projects, many of them are driven by simple curiosity and the desire to "touch the forbidden". Most people, even if they have a certain database of leaked data and access to a malware file, are unlikely to become cybercriminals. Not only because they "don't know how", but also because they don't set such goals for themselves.
What is the danger of this phenomenon?
Increasing the media footprint of cybercriminals is a double-edged sword. On the one hand, they get access to more potential customers who no longer need to install Tor and understand the structure of hacker forums.On the other hand, any conscientious user who believes that hackers and their activities are something far away and "will never touch it" can make sure directly from the search bar of their messenger that hackers are not movie characters, but very real people, whose victim can be any user of the network.
If we talk about moderation of Telegram, then it is certainly not aimed at encouraging hacker activity. This is noticeable, among other things, in the behavior of the hacker communities themselves, which are trying to attract the target audience to "shadow" resources. The methods used are very different, including advertising courses "on working on the Darknet", the content of which can hardly be legal by default.
Results
Based on the experience of hacker communities in Telegram, we can conclude that hackers are not marginals who can only "cluster" among their colleagues in closed forum branches. They know how to work with an audience, promote themselves, and find conditionally legal channels to attract potential customers to their projects. At the same time, they are quite capable of using advanced business experience and borrowing models of legal startups.For cybersecurity specialists, this, on the one hand, promises difficulties, as HPE and information about hacking techniques becomes more accessible. On the other hand, it is much easier to study "public" hackers, which can contribute to the introduction of preventive response practices to certain potential information security problems.
