Telegram is changing. Thanks to mounting pressure on public automated messaging channels, cyber threat actors are shifting their operational blueprints. They are doing what they can to evade automated moderation keywords and platform bans.
They are fighting against rapid security scraping and other strategies by migrating their operations to gated, private channels. Security analysts need to adapt to keep up.
One of the tools threat actors are utilizing in the migration is Telegram’s Request-to-Join feature. This feature puts prospective members into a holding queue where they must be approved before they can join a channel.
Threat actors are now vetting prospective members rather than publishing standard, open-invite hyperlinks that let anyone and everyone in.
In essence, threat actors are relying on sophisticated gatekeeping to put up a barrier against traditional cybersecurity frameworks. Security analysts must fight back by moving beyond basic public keyword sweeping into a more sophisticated, localized Telegram monitoring strategy.
How Gated Telegram Communities Function
DarkOwl, a threat intelligence firm and specialist in Telegram monitoring, explains that the platform’s Request-to-Join feature is an operational security shield.
It is quite effective because automated web crawlers are stopped dead in their tracks when they hit a Request-to-Join digital wall. They can go no further. As a gatekeeping practice, deploying the feature alters the threat adversary ecosystem in three ways:
- Vetting – Channel administrators often deploy specialized bots that parse an applicant’s profile. These automated tools are capable of weeding out people believed to be security researchers, law enforcement, and competitors.
- Longevity – Public Telegram channels are subject to swift action when they are found hosting active malware or stolen databases. But private channels do not appear in global search bars, making them harder to find. Private channels are subject to limited exposure, offering the data they contain exceptional longevity.
- Monetization – Just like legitimate business owners, private channel operators have discovered they can monetize membership. By requiring approval and attaching a fee to it, they create yet another revenue stream that generates profit, provides operational revenue, or both.
The challenge for security analysts and law enforcement is to create profiles that will pass the sniff test. If they can gain access to a private channel, their Telegram investigations are significantly enhanced by data they would otherwise not have access to.
Strategies for Beating the Gatekeeper
The whole point of Telegram monitoring is to stay abreast of adversaries and what they are doing. However, passive defense strategies are worthless in the Telegram realm.
They cannot penetrate gated networks. A security team hoping to conduct successful Telegram investigations must find a way to overcome the gatekeepers keeping them at arm’s length.
1. Personas and Managed Identities
As previously stated, security analysts must be able to carefully construct context-appropriate digital profiles that will get by the bots.
Doing so requires maintaining accounts that reflect realistic user activity. In essence, an analyst must create personas and managed identities that pass as the real thing.
2. Automated Referrals and Tracking
Threat actors leave breadcrumbs behind even when their activities are hidden behind request gates.
It is up to security analysts to leverage specialized threat intelligence scrapers to find these breadcrumbs by tracking forwarded messages and automated referrals. Security analysts can map such structural connections to identify individuals and groups.
There are other strategies analysts can utilize to get past gatekeepers. The most important thing to know is that threat actors are changing the way they do things on Telegram because cybersecurity teams and law enforcement are succeeding in penetrating public spaces. As threat actors move into gated communities, Telegram monitoring and investigations must account for that.