Cybercriminals Shift Focus: The Changing Landscape of Messaging Platforms

Key Takeaways

  • Criminal groups are exploring alternatives like Signal, Discord, and SimpleX as Telegram increases cooperation with law enforcement.
  • Despite stricter measures, Telegram's unique features, such as large group chats and bots, continue to attract bad actors.
  • Experts suggest additional ways Telegram could curb criminal activity, like limiting encrypted chat sizes.

  • Cybercriminals Shift Focus: The Changing Landscape of Messaging Platforms


    Will other platforms now become the new safe haven for cybercriminals?

    Telegram, once celebrated for its strong privacy features, finds itself at the center of controversy. With around 700 million global users, the platform is undergoing a transformation after its CEO, Pavel Durov, faced legal troubles in France. Changes to its privacy policies, particularly the willingness to share user data with authorities, have forced cybercriminals to rethink their strategies.

    For years, Telegram has been a hub for illicit activities. Now, with increased scrutiny, threat actors are starting to leave, but their departure is far from complete. Many are torn between staying for Telegram’s unique advantages and moving to emerging alternatives.


    The Migration Begins

    Platforms like Discord, Signal, and SimpleX are becoming new homes for cybercriminals. Some bad actors have already created channels and infrastructure on these apps, while others remain undecided. Telegram’s decision to cooperate with law enforcement—offering access to IP addresses, phone numbers, and user data—has fueled this shift.

    Despite these changes, many criminals are reluctant to leave entirely. Telegram’s features, such as "Supergroups" accommodating up to 200,000 members, broadcast channels, and bots for automation, are difficult to replicate elsewhere. These tools have become essential for their operations, from trading stolen data to distributing malicious software.

    Aryan Singh, a threat researcher at BforeAI, explained:


    "While there are alternatives to Telegram, no platform offers the same combination of features that the cybercriminal ecosystem relies on. These capabilities make Telegram indispensable."


    Where Are Criminals Going Next?

    Cyberint, a dark web intelligence firm, has noticed rising activity around alternatives like SimpleX. Mentions of SimpleX in underground forums have nearly doubled in recent months. While it appeals to certain groups, such as those in the U.S. and Europe, it remains less popular among Russian and Chinese-speaking criminals.

    Apps like Signal and Discord are also gaining traction, but they lack the large-scale engagement seen on Telegram. Groups on these platforms tend to be smaller, with limited activity and interaction.

    Experts predict that newer platforms like Session, which offers complete anonymity without requiring phone numbers or emails, could become viable replacements. Its disappearing messages and onion routing make it particularly appealing for those seeking privacy.

    Cyberint researchers examined links shared by cybercriminals, revealing that many were directing their members to platforms like Signal and Discord. Notably, Discord faced a ban and was blocked in Russia on October 8, 2024, according to Cyberint.
    Cyberint researchers examined links shared by cybercriminals, revealing that many were directing their members to platforms like Signal and Discord. Notably, Discord faced a ban and was blocked in Russia on October 8, 2024, according to Cyberint.

    Josh Copeland, Director of Managed Security at Quadrant Information Security, likened the situation to the mythical Hydra:


    "As one platform is shut down, two more take its place. Session might be the next big player for bad actors due to its anonymity and security-focused design."


    Implications for Social Media and Messaging Platforms

    As governments and tech companies collaborate to crack down on illegal activities, the ripple effects are being felt across the digital landscape. Paul Bischoff, a privacy advocate at Comparitech, compared this trend to China’s strict online regulations.

    However, some experts suggest that limiting features like group chat sizes could reduce criminal activity. Hauk, a cybersecurity analyst, argued:


    "There’s no legitimate reason for over 500 people to communicate in secret. Restricting group sizes could help combat issues like human trafficking, terrorism, and fraud."


    The Bigger Picture

    Telegram’s story reflects the ongoing battle between privacy and regulation in the tech world. While its recent changes aim to curb crime, they also highlight the challenge of balancing user safety with freedom.

    Even as cybercriminals explore new platforms, Telegram remains their preferred hub, thanks to its massive user base and feature set. However, the growing pressure from law enforcement and public scrutiny suggests that the platform's role in the criminal underworld may be diminishing.

    For now, the question remains: will other platforms step up to fill the void, or will stricter measures across the tech industry finally disrupt these networks?