How Telegram became a destination for criminals

The big picture: Telegram's relaxed content moderation policies and encrypted service offerings have made it an attractive destination for cybercriminals, terrorism organizations and drug dealers.

• Terrorist organizations, including ISIS, have used Telegram to publicly claim responsibility for attacks.
• Politically motivated hackers — including those tied to the war in Ukraine and the Israel-Hamas war — also post about their crimes in public Telegram forums.

Experts say Telegram has unique features that — taken in combination — hackers have been able to abuse in an effort to hide their activities.

• Secret Chats allows users to turn on end-to-end encryption.
• That means Telegram has no way of seeing what's discussed in Secret Chat conversations. Users also can't forward these messages, and they can self-destruct — making it even harder for third parties to intercept their contents.
• Apple Messages and WhatsApp messages are also encrypted by default, but neither allow users to sign up with a virtual phone number.
• Telegram accounts don't need to be linked to a SIM card, Taisiia Garkava, an intelligence analyst at Intel 471, told Axios.

Between the lines: Telegram allows hackers to communicate in real time with little interruption.

• In contrast, messaging features in dark web forums typically aren't encrypted and have a lag since they operate similarly to email.
• Telegram is also unlikely to go completely dark as part of a law enforcement crackdown — unlike a dark web forum.

Telegram's terms of service and moderation are vague enough that illegal activity, including the spread of child sexual abuse material, is allowed to flourish.

• As Casey Newton points out in Platformer, Telegram users are officially prohibited from posting illegal pornographic content, but only in public channels, not in private ones.
• "All Telegram chats and group chats are private amongst their participants," a FAQ on Telegram says. "We do not process any requests related to them."

Zoom in: Killnet, a pro-Russia politically motivated hacker group, is a prime example of how cybercriminals have used Telegram's more public channels.

• The group coordinates attacks and shares malicious scripts in real time via a publicly viewable channel.
• Typically, the group starts by publishing a long list of potential targets for its distributed denial of service attacks. Those targets have included websites belonging to U.S. hospitals, airports and others.
• In September 2022, the group created a separate so-called supergroup, which can support up to 5,000 people, with the sole purpose of recruiting new members, according to analysts at Flashpoint.

The intrigue: Cybercriminals also find Telegram's overseas ownership appealing, Synack co-founder and CTO Mark Kuhr told Axios.

• Telegram was originally founded in Russia but moved to the United Arab Emirates in 2017.
• "There's less of a perceived risk of law enforcement cooperation," Kuhr said in an email.
• Telegram also "rarely cracks down on message boards, giving more breathing room for cybercriminals to talk openly before getting kicked off the platform," he added.

Yes, but: Telegram is still a destination for legitimate, real-time communications.

• The Ukrainian army has been broadcasting its actions on the app since Russia's invasion in 2022.

Go deeper: What to know about Telegram CEO Pavel Durov