Telegram – the instant messaging platform popular with ransomware groups and cybercriminals because of its user privacy features – recently updated its privacy policy in an effort to discourage criminals from abusing the platform. On September 23, Telegram’s CEO announced the new policy, which now states:
“If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.”
Previously, the policy would only disclose user information to law enforcement if Telegram received a court order confirming the individual was a terror suspect and further stated in the policy that “so far, this has never happened.” According to Telegram’s new policy, any user data shared with law enforcement will be published in a quarterly report by the company.
In addition to the change in its privacy policy, Telegram’s CEO Pavel Durov also announced that the company removed illegal content from its search feature, and a moderator team will continue to review search content to prevent criminals from using the platform to market illegal content.
Why the Sudden Change of Heart?
While the changes are a positive step towards curbing criminal abuse of Telegram, the timing also occurred just weeks after Durov was arrested in France and investigated for complicity in allowing criminal activity to occur on the platform. As Arete reported back in February, Telegram’s data privacy features made it popular with cybercriminals, who have used it for a number of illegal activities, including information sharing and communication with other cybercriminals, selling and distributing malware and tools, and leaking sensitive data stolen from cyberattacks.
So, These Policy Changes Will Deter Criminals, Right?
Maybe, but its use specific to cybercrime will likely remain unchanged in the near term. Abuse of the platform by cyber threat actors is just one of many illicit activities that occur on Telegram, which also include things such as drug trafficking, child sex abuse, and channels tied to terrorism and extremism. Curbing the broad range of criminality that occurs on Telegram will largely depend on how often the company agrees to requests to disclose users’ information to law enforcement. Additionally, while introducing moderators is a positive step in proactively preventing illegal material from getting posted, its effectiveness will ultimately be determined by the amount of resources Telegram devotes to policing its content.
Related Resources
![]()
Rhysida Using Oyster Backdoor in Attacks
The Rhysida ransomware group has been using the Oyster backdoor in attacks, leveraging fake websites to trick users into downloading malicious software.
Read more![]()
New Group Emerges with Similarities to ALPHV/BlackCat
Cicada3301, a new RaaS group, emerged in June 2024. Using double extortion, they target Windows and Linux/VMware ESXi systems, posting victims on their dark website. Their methods show strong similarities to ALPHV/BlackCat ransomware.
Read more![]()
Iranian Hackers Working with Ransomware Groups
An Iranian threat group linked to the GOI collaborates with ransomware affiliates, aiding network access and extortion for a ransom share.
Read more
