Telegram – the instant messaging platform popular with ransomware groups and cybercriminals because of its user privacy features – recently updated its privacy policy in an effort to discourage criminals from abusing the platform. On September 23, Telegram’s CEO announced the new policy, which now states:
“If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.”
Previously, the policy would only disclose user information to law enforcement if Telegram received a court order confirming the individual was a terror suspect and further stated in the policy that “so far, this has never happened.” According to Telegram’s new policy, any user data shared with law enforcement will be published in a quarterly report by the company.
In addition to the change in its privacy policy, Telegram’s CEO Pavel Durov also announced that the company removed illegal content from its search feature, and a moderator team will continue to review search content to prevent criminals from using the platform to market illegal content.
Why the Sudden Change of Heart?
While the changes are a positive step towards curbing criminal abuse of Telegram, the timing also occurred just weeks after Durov was arrested in France and investigated for complicity in allowing criminal activity to occur on the platform. As Arete reported back in February, Telegram’s data privacy features made it popular with cybercriminals, who have used it for a number of illegal activities, including information sharing and communication with other cybercriminals, selling and distributing malware and tools, and leaking sensitive data stolen from cyberattacks.
So, These Policy Changes Will Deter Criminals, Right?
Maybe, but its use specific to cybercrime will likely remain unchanged in the near term. Abuse of the platform by cyber threat actors is just one of many illicit activities that occur on Telegram, which also include things such as drug trafficking, child sex abuse, and channels tied to terrorism and extremism. Curbing the broad range of criminality that occurs on Telegram will largely depend on how often the company agrees to requests to disclose users’ information to law enforcement. Additionally, while introducing moderators is a positive step in proactively preventing illegal material from getting posted, its effectiveness will ultimately be determined by the amount of resources Telegram devotes to policing its content.
Related Resources
![]()
Interlock: An Emerging Ransomware Threat
An analysis of the Interlock ransomware group, their tactics, and their impact across various industries.
Read more![]()
Malware Spotlight: Akira Ransomware
Arete has responded to over one hundred incidents attributed to the Akira ransomware group. This spotlight explores Akira’s observed behavior, statistics from Incident Response engagements, and a technical analysis of Akira’s ransomware executable.
Read more![]()
Black Basta Leverages New Social Engineering Technique
Black Basta, a ransomware group active since at least April 2022, is deploying a new social engineering tactic using Microsoft Teams in an active campaign.
Read more
