Telegram: Malicious and Beneficial Uses, An Evaluation from an OPSEC and CTI Perspective

Telegram is a messaging platform known for its privacy and security features. However, these features have led to both its misuse by criminal organisations and its use as useful software in the cybersecurity industry and for operational security (OPSEC) applications. In this article, we will examine the two-way use of Telegram, the arrest of founder Pavel Durov, and how this platform can be evaluated from a CTI and OPSEC perspective.

The Dark Side of Telegram

Telegram, with its end-to-end encryption and anonymity, is used by criminal organisations for various illegal activities. Drug trafficking, fraud, money laundering, sharing child abuse content and support for terrorism are among the common offences on this platform.

Support for Terrorism: Terrorist organisations use Telegram to spread propaganda, recruit new members, provide financial support and issue operational instructions. The encryption features offered by the platform allow these organisations to communicate securely and keep their plans secret. Furthermore, Telegram channels and groups are used to recruit sympathisers and accelerate the radicalisation process by broadcasting ideological content.

Drug Trafficking: Drug dealers and traffickers trade drugs using the secure and difficult-to-trace communication channels offered by Telegram. Dealers are able to communicate anonymously with their customers and receive orders and share delivery details through confidential channels. This helps to move the drug trade to digital platforms and hide it from law enforcement agencies.

Partnership in Crime: Telegram can be used as a platform where criminals communicate with each other and coordinate organised crime activities. In particular, organised crime gangs plan their operations, share information and coordinate within the group via Telegram. In this way, criminals can create a secure communication network by losing their traces.

Mass Fraud: Fraudsters create groups on Telegram to share illegal material, such as fake credentials, stolen credit card data, etc., and to carry out fraudulent activities. These groups enable fraudsters to exchange information with each other and easily carry out their illegal transactions. At the same time, new fraud methods are developed and spread through this platform.

Money Laundering: Money laundering activities are organised on platforms such as Telegram. Funds obtained illegally are laundered through this platform and kept secret. People who want to hide the proceeds of crime and lose their traces perform complex money transfer transactions via Telegram and set up special groups for these transactions.

Crime Concealment: Perpetrators of crime use Telegram to communicate without leaving traces and to conceal their identities. Thanks to its encrypted messaging feature, this platform allows its users to protect their identities and continue their activities safely. In particular, Telegram stands out as an ideal communication tool for criminals who want to avoid being tracked.

Paedophilia Content: Unfortunately, child abuse and paedophilia content is shared through secret groups on Telegram. Such groups allow malicious individuals to come together to share illegal content and communicate with those who consume it. The detection and closure of these groups creates difficulties due to the encrypted nature of the platform.

Sanctions Evasion: Some countries and individuals may use Telegram to avoid international sanctions. This platform allows individuals and countries subject to sanctions to conduct clandestine trade and economic activities. In particular, countries subject to economic sanctions develop alternative trade routes through Telegram.

Human Trafficking: Human traffickers may use Telegram to organise human trafficking and migrant smuggling activities. Telegram serves as a means of communication and coordination in the conduct of these criminal activities. Through this platform, traffickers communicate with victims, make plans and carry out their operations in secret.

Arms trafficking: Groups engaged in the illegal arms trade can use Telegram as a communication and trading platform. Specialised groups and channels created through Telegram enable the arms trade to be carried out securely. These groups facilitate the illegal arms trade by establishing direct communication between buyers and sellers.

Useful Aspects of Telegram

Telegram can be effectively used not only by criminals, but also by CTI analysts and OPSEC applications. The platform’s security and anonymity features offer effective tools for sharing sensitive information and gathering threat intelligence.

Secure Communication and Information Sharing: End-to-end encryption makes sharing confidential information secure. This ensures that CTI analysts in particular remain secure when sharing sensitive information.
Anonymity and Private Groups: Offering the ability to remain anonymous, Telegram allows security professionals to create secret groups to gather and analyse threat intelligence. In these groups, information about cyber threats or new attack methods can be shared.
Monitoring and Alert Mechanisms: By monitoring Telegram channels, CTI analysts can gather information about new threats and take proactive measures. They can also monitor channels that issue warnings about cyber attacks or potential threats.

Arrest of CEO Pavel Durov

Telegram founder Pavel Durov was arrested by French authorities at Paris-Le Bourget Airport. The reason for his arrest was Durov’s failure to supervise criminal activity on the platform and allowing criminal organisations to abuse it. This incident has sparked an international debate about the legal responsibilities of platform administrators and their obligations to prevent criminal activity. This arrest could significantly impact Telegram’s future security policies and approach to protecting user data.

The Mysterious Journey of Pavel Durov and Juli Vavilova

Simultaneously with the arrest process of Pavel Durov, the identity of the mysterious woman accompanying him was also revealed. As a result of OSINT investigations, it was revealed that this person was Juli Vavilova, known for her remarkable posts on social media. The photos of the duo, who made a series of trips especially in Azerbaijan, Uzbekistan and Kazakhstan, were revealed as a result of careful analysis of their social media posts.

Julia was not publicly recognised as Pavel Durov’s girlfriend. On 25 June in Uzbekistan, Pavel and Gusein and a blonde woman, whose identity was unknown at the time, were seen together. It is possible that Durov has long been under surveillance by several intelligence services, and this blonde woman could possibly be linked to them.

• Pavel Durov announced the visit of the Telegram delegation to Azerbaijan in a post on his VK account on 21 August. During this visit, Durov honed his target shooting skills and prepared for Formula 1. In addition, Julia shared a video about the same visit on her Instagram account. The post was supported by two videos.

• Julia posted on her Instagram account a video of Pavel Durov’s visit to Azerbaijan, filmed at the same shooting range. This video was presented in line with the VK post about the events where Durov was honing his target shooting skills and preparing for Formula 1.

Julia and Pavel Durov have also been together in Uzbekistan.

Julia and Pavel Durov have also been to Kazakhstan together.

This incident shows how easy it is to follow the social media trail of celebrities and how important OPSEC rules are.

Recommendations for CTI and OPSEC

Given both the abusive and beneficial aspects of Telegram, CTI analysts and security professionals can adopt the following strategies:

1. Avoid Real-Time Location and Activity Sharing

Sharing this information instantly on social media while traveling or attending an event poses a great risk. Such posts can show malicious individuals or groups following you where you are and when you will be there. Therefore, it is safer to share general information after visits are over and when there is no security risk. However, it is important to avoid revealing exact location and date information.

2. Do Not Disclose Confidential and Proprietary Information

Sharing sensitive information on social media, such as target practice or special preparation, can provide a strategic advantage for potential competitors or adversaries. It is safer to keep such information as private as possible or share it only with trusted circles through private channels.

3. Delay Posting

If you need to post about an event or a trip, it is a good strategy to post a few days or weeks later. This reduces potential threats and minimizes the risk of a possible attack.

4. Reduce Personal Relationships and Private Life Details

Personal information such as who you travel with, who you spend time with, etc. should not be overly visible on social media. Such information allows followers or potential threat actors to understand your social circle and relationships and can increase your security risk.

5. Check Privacy Settings Regularly

It is important to regularly review the privacy settings of your social media accounts. Sharing information only with trusted contacts and avoiding public posts is one way to prevent information from falling into the wrong hands.

6. Track and Manage Your Social Media Footprints

Keeping track of what information about you is spread on the internet is an important part of OPSEC. Regularly monitor your own posts and others who tag you or post about you, and manage this information if necessary.

7. Limit Social Media Use

Minimizing social media use, especially during sensitive missions or while traveling, can reduce potential risks. This is an important step to ensure the safety of both you and the people around you.

Conclusion

Telegram offers strong privacy and encryption features, which are both abused by criminal organizations and provide significant advantages for CTI analysts and security professionals. In order to prevent criminal activity and promote secure communications, a balanced assessment of both the negative and positive aspects of the platform is required.
CTI analysts and security professionals should carefully monitor Telegram and take the necessary precautions. Proactive strategies and collaborative approaches should be adopted to prevent abuse by criminal organizations and make the best use of the platform’s beneficial aspects. This will increase the security of the platform, allowing users to interact in a safer environment.