Telegram for cybercriminals remains a top choice in 2025, offering anonymity, easy file sharing, and mass communication with little oversight. This is despite strong cyber vigilance and stringent policies.  Its privacy, lax moderation in private chats, and support for Telegram bots continue to attract malicious actors. As per the statistical reports of DemandSage  in March 2025 active users of Telegram have crossed 1 billion globally, giving cybercriminals unmatched access to a massive audience.

A February 2025 analysis from CyberSecurityNews identified Telegram as the number 1 messaging platform used by cybercriminals, surpassing alternatives like Discord, Signal, Tox, or Session. Cyber investigators traced over 80 million unique identifiers and channel links from dark web forums back to Telegram. 

Similarly, a recent academic study of 339 criminal channels by arXiv revealed that cyber criminal groups collectively have reached 23.8 million followers. They have been actively distributing malware, stolen data, and phishing kits between February and May 2024 .

In another key signal, Telegram responded to over 22,000 law enforcement data requests in the first quarter of 2025, highlighting its central role in cybercrime investigations. This was as per the reports by GitHub that regularly reposts the Telegram transparency policy.(404 Media).

A May 2025 global takedown of the Lumma infostealer operation confirmed that Telegram was used to coordinate malware distribution and support activities among cybercriminals (Wired).

Telegram isn’t just a tool; it’s infrastructure. And for now, it still enables cybercrime at scale. 

Key Takeaways

• Most of the threat actors who claimed to leave Telegram never actually did.
• Signal and Discord are used, but mainly as backups—not primary platforms.
• Telegram still dominates with over 246,000 shared links per month.
• Criminal groups return to Telegram even after public exits.
• Real shifts in behavior matter more than public statements.

This blog gives you an insight into why cyber criminals still love Telegram in spite of having other alternatives.

Telegram Quick Stats That You Should Know

• 1 billion monthly active users as of March 2025.
• 450 million people use Telegram every day.
• 10 million users have signed up for Telegram Premium worldwide.
• In India, about 45% of the population uses Telegram regularly. In contrast, just 9% of Americans are on the platform.
• Most users—around 53.2%—fall between the ages of 25 and 44.
• On average, users spend about 3 hours and 45 minutes on Telegram each month.
• Telegram made $11.66 million in in-app revenue in just the first two months of 2024.
• Since its launch, the platform has raised over $4 billion in funding.

Telegram Still Beats Discord and Signal in Cybercrime Circles

Telegram remains the top choice among cybercriminals, even with the rise of alternatives like Signal and Discord. Analysis by Kela reveal shared links across dark web forums shows Telegram far ahead in usage. These links usually point to invite-only groups—not general chats—so they give a real sense of where threat actors are gathering.

Signal and Discord offer similar features: group creation, community support, and easy sign-up. But they’re not catching up fast. After Pavel Durov’s arrest on August 24, 2024, there was a slight uptick in Signal links. Still, the activity came mostly from just five Telegram groups promoting the same links over and over. That’s not growth, it’s echo.

Discord gets mentioned now and then, but investigations suggest that there has not been any real increase in links pointing to its servers either.

Between August and December 2024, Signal and Discord together averaged just 682 shared links per month. Telegram, on the other hand, saw a massive 246,903 shared links monthly in the same time frame. Even after filtering out repetitive posts from the same groups, Telegram remains dominant.

The message is clear. The criminal communities haven’t moved. Telegram is still where the action is.

Why Threat Actors Haven’t Really Left

After Telegram’s policy shift and Pavel Durov’s arrest in August 2024, several cybercriminal groups claimed they would leave the platform. Some announced plans to move to Signal or other “secure” spaces. But in reality, most of them never left—or came right back.

For instance, take the case of Team ARXU™, a pro-Bangladeshi hacktivist group. On September 26, 2024, they said they were moving to Signal for “more secure and private chat.” They shared a Signal group link and urged followers to join. Three months later, their Telegram channel is still active, now nearing 2,000 subscribers.  And the Signal group link no longer works.

The Bl00dy Ransomware Gang made a similar claim. On September 24, 2024, they declared they were quitting Telegram. Activity on their channel stopped—but only for a month. On October 24, they launched a new Telegram channel and went back to posting ransomware updates. They even advertised the new channel on their X account.

Al Ahad, an Iraqi anti-Israeli hacktivist group, also promised to migrate to Signal. But instead of quitting Telegram, they opened a Hebrew-language Telegram channel and rebranded part of their operation as Al Ahad Security. They even updated their group description to say they follow Telegram’s rules and oppose terrorism—while continuing to repost content related to pro-Palestinian cyberattacks.

These examples show a pattern: groups talk about moving, but they rarely do. Most simply create backup channels elsewhere. Telegram remains their primary space.

Reasons Why Telegram Still Favored by Cybercriminals

Telegram has long been favored by cybercriminals because it offers reach, ease of use, and limited moderation. Even after the arrest of its CEO and changes in platform rules, criminals haven’t walked away. Here are a few critical reasons.

Easy anonymity – Users can sign up with a virtual or disposable number. No ID checks, no questions.
Low moderation – Even if a channel gets banned, it usually reappears under a new name within hours.
Built-in storage – Files, tools, and stolen data are stored in the cloud. Everything is searchable and accessible anytime.
Massive reach – Channels can have unlimited followers, making it easy to promote scams or leaks to thousands in one go.

KELA’s ongoing tracking gives enough proof:

• No drop in daily activity among cybercriminal groups on Telegram.
  
• No real surge in group migrations to other platforms.
  
• Those who talked about leaving—none fully transitioned.
  

Platforms like Signal and Discord are being used—but not as replacements. They’re just extras. Telegram still holds the network, reach, and tools threat actors rely on.

To Sum Up

Talk is cheap in the cybercrime world. Public claims to leave Telegram are mostly for show. In practice, the groups stay put. The cybercrime ecosystem is unpredictable. It shifts, adapts, and keeps looking for loopholes. That’s why real-time monitoring is key. Just because they say they’re leaving doesn’t mean they are.