The collection of threat information is one of the key activities for the Cyber Threat Intelligence operations of a Security Operations Center (SOC). The analysis of communication channels used by cybercriminals represents an important source of data. Among these, Telegram has established itself as one of the preferred platforms for threat actors to exchange information, sell stolen data, or plan attacks.
In this article, we will analyze the role of Telegram in CTI and the strategies to effectively monitor these channels.

Why monitor Telegram?

Telegram is a platform that combines some particularly attractive features for cybercriminals:

1. Anonymity and Privacy: Thanks to the possibility of using pseudonyms and end-to-end encryption, Telegram guarantees relative anonymity to users.
2. Accessibility and Usability: Creating and managing channels or groups is simple and does not require advanced technical skills.
3. Rapid information dissemination: Public and private channels allow quick sharing of news, malware, hacking tools, and data leaks.
4. Limited moderation: Unlike other platforms, Telegram has less strict moderation, which often allows illegal content to remain online longer.

These features have turned Telegram into a reference point for illicit activities, such as the sale of stolen credentials, compromised accounts and sensitive data, and also the distribution of malware and exploit kits.

For a SOC, monitoring Telegram can provide valuable information in terms of:

• Detection of Imminent Threats: Information on new attacks or exploited vulnerabilities.
• Identification of Indicators of Compromise (IoC): IP addresses, malicious file hashes, or URLs used for phishing.
• Understanding Tactics, Techniques and Procedures (TTP): By analyzing the behavior of threat actors, it is possible to anticipate their moves.
• Proactive Protection: Integrating this information into SOC defenses to prevent future attacks.

Strategies for Monitoring

Monitoring threat actor channels on Telegram therefore proves to be essential. However, it may not turn out to be a trivial task, requiring both intelligence and automation capabilities. Let’s try to see together how to do it, starting by dividing the process into steps:

1. Access to Relevant Channels
   To begin, it is essential to identify the most relevant channels, groups, or bots. This can be done:

• Through Manual Search: Using keywords related to malware, ransomware, or illicit activities.
• Collaborating with Intelligence Partners: Receiving reports of channels already known for illicit activities.

1. Automation Tools
   The use of scraping and automated monitoring tools can facilitate data acquisition. However, attention must be paid to:

• Respecting Regulations: Data scraping must be carried out in compliance with local and international laws.
• Avoiding Detection: Threat actors often monitor access to their channels, so it is necessary to use accounts or methods that mask SOC activities.

1. Content Analysis
   Once the information is collected, it must be analyzed:

• Identify Compromised Credentials: There are many channels that share this kind of information even for free. They may be credentials exfiltrated directly from infostealers, or large data collections from different sources.
• Extract IoC: IP addresses, malicious URLs, and files can be compared with threat intelligence databases.
• Identify Behavioral Patterns: Understand how cybercriminals operate and which tools they use.
• Monitor Discussions: Pay attention to emerging trends, such as the use of new exploits or innovative phishing techniques.

Useful Resources

The main difficulty lies in identifying useful resources and channels that actually provide relevant information. Clearly, the most interesting channels will be those containing data of direct interest to your organization.
To identify them, an effective approach is to use Telegago, a search engine specialized for Telegram, based on Google’s advanced search (PSE). This tool allows filtering by keyword, identifying potentially useful chats and channels that may contain sensitive information. For example, it is possible to search the keywords “[organization name] log” to identify channels sharing access credentials related to your organization.
Another fundamental resource is DeepDarkCti, a collection that includes the main Telegram channels known, directly managed by Threat Actors and organized criminal groups.
Once the channels of interest are identified, it will be very useful to proceed with scraping their content. On this topic, we refer you to our guide to Telegram scraping, where we explain step by step how to carry out this activity.

Challenges to Face

Despite the advantages, monitoring Telegram also entails some challenges:

• Data Volume: The contents are vast and require careful analysis to avoid false positives.
• Risk of Exposure: Threat actors may notice monitoring activities and adopt countermeasures.
• Legal Compliance: Operating in compliance with privacy and data use regulations is essential.
  Collaboration with other cybersecurity organizations is crucial. Sharing collected information through platforms such as ISAC (Information Sharing and Analysis Center) can increase collective defense capabilities against threat actors.

Conclusions

Telegram has become a fundamental tool for cybercriminals, but it also represents an invaluable source of information for SOCs. Monitoring threat actor channels allows obtaining useful information to strengthen defense against cyber threats. However, this activity requires a structured approach, adequate tools, and a deep knowledge of the operational context. Only in this way is it possible to transform the informational chaos of Telegram into a strategic advantage for corporate security.