We have talked many times about how most criminal groups and illicit activities have largely moved from the dark web to Telegram, since it is able to offer a similar level of anonymity but with the ease of use and accessibility of a messaging application.
In the cybersecurity field, an encrypted and decentralized communication platform like Telegram is ideal for coordination, exchanging attack tools, sharing information on zero-day vulnerabilities, and even selling stolen data.
For a Security Operations Center (SOC), therefore, integrating a Telegram scraping tool into the workflow of its Cyber Threat Intelligence (CTI) team has become not only useful, but essential. Let’s see why and how to do it.


Why Monitor Telegram?

  1. The Central Role of Telegram in Malicious Activities
    Telegram has become a preferred platform for cybercriminals over the last few years. Some examples of content that can be intercepted include:
    • Exchanges of stolen credentials.
    • Malware and exploits shared in specific groups.
    • Discussions on trends in attack techniques.
    • Reports of new vulnerabilities.
    Being able to collect information directly from the “enemy sources” allows CTI teams to anticipate attackers’ moves, providing timely intelligence that can be used to improve defenses and create proactive alerts.
    Telegram is vast and constantly moving. Manually monitoring its contents is inefficient and prone to errors. Well-implemented scraping, on the other hand, can collect data systematically and comprehensively.
    Some tangible advantages that this activity offers within a SOC are:
    • Proactive Threat Intelligence: Identify new threats before they strike.
    • Faster Response: Timely information helps incident response teams react better.
    • Deeper Knowledge of the Threat Landscape: Understand emerging trends and major malicious actors.

How to Implement Telegram Scraping?

  1. Preparation: Define the Objectives
    Before implementing a scraping tool, it is essential to define the targets:
    • Relevant channels and groups: Identify channels known for suspicious activities.
    • Keywords: Configure searches based on sensitive terms, such as “RDP,” “botnet,” or “zero-day.”
  2. Usable Tools
    There are several open-source tools and frameworks that can be adapted for Telegram scraping, including:
    • Telethon: A Python library to interact with the Telegram API. Ideal for automating message collection.
    • Telegram API: The official API allows access to public channel content and programmatic searches.
    • Custom Bots: Create customized bots to collect structured data or trigger alerts based on specific triggers.
  3. Technical Implementation
    In this article we will see a simplified example of scraping, using the open-source Telethon library:

from telethon import TelegramClient
# Client configuration
api_id = 'API_ID'
api_hash = 'API_HASH'

client = TelegramClient('session_name', api_id, api_hash)

async def main():
  # Connection to a public channel
  async for message in client.iter_messages('channel_name'):
    print(message.text) # Log of messages

with client:
  client.loop.run_until_complete(main())

This script allows collecting messages from a specific channel. It can be further enriched with filters and text analysis.
Let’s see a practical case: suppose we are interested in monitoring ransomware compromises to identify criticalities in the supply chain. We identify the Telegram channel of interest, such as RansomWatcher.

At this point, we need to adapt the Python script to the channel in question.
First, it will be necessary to enter the following parameters:
api_id # Your API ID
api_hash # Your API Hash
phone_number # Your phone number

To obtain the first two, you will need to log in to your main Telegram account: my.telegram.org. Then go to “API development tools” and fill out the form.
Once done, you will be able to obtain the main addresses, in addition to the api_id and api_hash parameters necessary for user authorization. Remember, each number can be associated with only one api_id.

import csv
from telethon import TelegramClient

api_id = 'YOUR_API_ID'
api_hash = 'YOUR_API_HASH'

client = TelegramClient('session_name', api_id, api_hash)

async def main():
  with open('messages.csv', 'w', newline='', encoding='utf-8') as file:
    writer = csv.writer(file)
    writer.writerow(['date', 'sender', 'message'])
  async for message in client.iter_messages('channel_or_group'):
    writer.writerow([message.date, message.sender_id, message.text])

with client:
    client.loop.run_until_complete(main())

Let’s complicate things a bit and introduce the ability to scrape multiple channels simultaneously. In addition, we probably will not need all the chat messages: so let’s try to get only the messages from the last day.

Unfortunately, the Telegram API (and therefore also the Telethon library) does not provide a parameter to request only messages from the last 24 hours directly. This means there is no native way to do targeted scraping with a single API command.
The closest approach to a targeted request is to limit the number of messages to download and apply a manual time filter.


from telethon import TelegramClient
from datetime import datetime, timedelta, timezone
import csv

# Main variables
api_id = 123456 # Your API ID
api_hash = 'abcdef1234567890abcdef1234567890' # Your API Hash
channels = ['public_channel1', 'public_channel2'] # Replace with the names/IDs of the channels
# Client connection
client = TelegramClient('session_name', api_id, api_hash)

async def scrape_messages():
  # Time period: last 24 hours, timezone-aware with UTC
  twenty_four_hours_ago = datetime.now(timezone.utc) - timedelta(days=1)

  # Open a CSV file to save the data
  with open('messages_last_24h.csv', 'w', newline='', encoding='utf-8') as file:
    writer = csv.writer(file)
    writer.writerow(['date', 'channel', 'sender', 'message'])

    for channel in channels:
      print(f"Scraping messages from channel: {channel}")
      async for message in client.iter_messages(channel, limit=1000):
      # Compare only messages from the last 24 hours
      if message.date and message.date > twenty_four_hours_ago:
        if message.text:
          writer.writerow([message.date, channel, message.sender_id, message.text])
        else:
          break

with client:
  client.loop.run_until_complete(scrape_messages())

If you want to maximize efficiency:

  1. Reduce the limit of downloaded messages:
    o Use the limit parameter to download only a specific number of recent messages (e.g. limit=1000).
    o This reduces the data processed.
  2. Use multiple parallel instances of Telethon:
    o If you are monitoring many channels, you can use Python asyncio to run parallel scraping on multiple channels.

Data Analysis

After scraping, the data must be analyzed to extract useful insights. Use text mining and machine learning techniques to identify patterns, correlations, and anomalies.


Daily Term
Can you guess today’s cybersecurity word in 6 tries?
Play now

Conclusion

Telegram scraping represents an important opportunity to strengthen the CTI team’s capabilities within a SOC. Not only does it allow the interception of emerging threats, but it also contributes to building a cybersecurity ecosystem based on intelligence. In an increasingly complex and threatened world, knowing where to look can make the difference between suffering an attack and preventing it.