Hunting Cyber Threat Intelligence on Telegram

Hunting Cyber Threat Intelligence on Telegram

Speakers: Emmanuele Zambon (Eindhoven University of Technology); Luca Allodi (Eindhoven University of Technology); Roy Ricaldi (Eindhoven University of Technology); Victor Asanache (Eindhoven University of Technology)

Conference: FIRST CTI Conference

YouTube: https://www.youtube.com/watch?v=IBvwQlNHAvk

Overview

In an increasingly fragmented and noisy cybercriminal landscape, monitoring platforms like Telegram for actionable Cyber Threat Intelligence (CTI) presents a significant challenge. This talk, presented by Luca Allodi and Roy Ricaldi from Eindhoven University of Technology, introduces their innovative research and tools, TeleHunt and Television, designed to efficiently discover and analyze cybercriminal communities on Telegram. The core problem addressed is the difficulty of extracting credible and relevant threat information from a vast, often nonsensical, and constantly evolving environment, where traditional monitoring methods quickly become overwhelmed.

The researchers highlight that while cybercriminal activities have shifted from more structured forums to dynamic messaging apps, the fundamental need for intelligence professionals to understand threat actors' modus operandi, communication patterns, and capabilities remains. Their work aims to bridge the gap between high-level understanding of cybercriminal ecosystems and low-level operational data, enabling earlier and more informed defensive actions. By focusing on a "human-in-the-loop" approach, their methodology leverages automation to identify signal within the noise, providing a structured way to navigate Telegram's chaotic environment and transform raw data into actionable CTI.

This research is particularly pertinent for CTI practitioners, security analysts, and law enforcement agencies struggling to keep pace with the rapid evolution of cybercriminal communication channels. The ability to systematically identify, classify, and understand the relationships between various threat communities on Telegram offers a critical advantage in threat landscaping, actor characterization, and proactive defense. The talk not only presents a novel technical solution but also emphasizes a scientific, evidence-based approach to CTI, grounded in real-world operational experience from their own Security Operations Center (SOC).

Background

▶ Watch: Introduction: Hunting Cyber Threat Intelligence on Telegram (0:00)

The evolution of cybercriminal communication platforms has seen a significant shift over the past decades. Beginning with early IRC channels, moving through more structured underground forums, the landscape has now largely transitioned to messaging applications like Telegram and Discord. While forums offered a degree of structure, moderation, and rule-based interaction, Telegram presents a highly fragmented, noisy, and rapidly expanding environment. This shift poses considerable challenges for CTI professionals attempting to monitor and derive usable intelligence. The sheer volume of data, coupled with a high signal-to-noise ratio, makes it easy to get lost in irrelevant information or encounter non-credible actors sharing misinformation.

The Eindhoven University of Technology research group, which operates its own commercial Eindhoven Security Hub SOC (ESH SOC) and is establishing a CTI lab, approaches CTI from two levels: a high-level study of cybercriminal ecosystems (identifying groups, targets, communication patterns, and modus operandi) and a lower-level analysis of operational data (logs, TTPs). Their overarching paradigm is to bring these two levels as close as possible, using high-level insights as a "scaffolding" to interpret low-level data and anticipate mounting attacks.

Their prior work on underground forums demonstrated the effectiveness of characterizing these spaces along "social technical dimensions," drawing parallels to economic concepts like moral hazard and adverse selection. This allowed them to differentiate between credible ("wheat group") and non-credible ("chaff group") forums. A notable success story was their early identification of Genesis Market as a significant emerging threat in 2017-2018, long before its eventual takedown in Operation Cookie Monster. This success highlighted the importance of understanding the underlying social and technical mechanisms that foster credibility within criminal communities. The challenge, however, is adapting this framework from the structured environment of forums to the unstructured, dynamic nature of Telegram. This fundamental problem—how to monitor and extract meaningful CTI from Telegram's highly fragmented and noisy environment—forms the impetus for their TeleHunt and Television research.

Key Findings

▶ Watch: TeleHunt: Efficient cybercriminal community discovery tool (10:00)

The research presented unveils several critical findings regarding the discovery and analysis of cybercriminal activity on Telegram:

1. Efficient Discovery through Contextual Snowballing: The TeleHunt tool demonstrates that it's possible to efficiently discover cybercriminal communities on Telegram by starting with initial "seeds" and iteratively exploring new communities. Crucially, this process avoids getting lost in irrelevant data by considering the context of messages containing pointers (links, handles, forwards) to other communities. This contextual awareness significantly reduces "dead ends" and wasted API calls, allowing the discovery process to remain focused on relevant cybercriminal content.

1. Links as Primary Drivers of Discovery: Test runs revealed that configurations including links for snowballing yielded the highest discovery rates, highest overall yield, and stable precision. Specifically, links demonstrated an exponential influence (quantified at 2.24) on the number of communities found, far surpassing the impact of other pointer types like handles. This highlights the indispensable role of links in navigating the Telegram ecosystem.

1. Timeliness of Link Extraction is Paramount: A significant portion of "dead ends" and wasted resources were attributed to expired links, particularly those for private communities. Administrators of private Telegram communities can set expiration times (e.g., 3 or 7 days) for their invitation links. This means that extracting and following pointers must be a timely process, as older links quickly become inactive and unusable, hindering discovery.

1. Dominance of Public Communities, but Private and Vetted Exist: The majority of discovered communities were public (searchable, with standard t.me/community_name links and handles). However, the research also identified a considerable number of private communities (accessible only via random-hash links, no handles) and even a few vetted communities (requiring administrator approval after joining via a link). This indicates a layered access control model within the ecosystem, with varying degrees of openness.

1. Vast, Fragmented, and Expanding Ecosystem: The analysis showed very low rediscovery rates across multiple iterations, suggesting no strong evidence of saturation within the observed cybercriminal ecosystem. This implies that the Telegram landscape for CTI is exceptionally large, highly fragmented, and continuously expanding, presenting a persistent and significant challenge for practitioners.

1. Emergence of Natural Structure in Chaos: Perhaps the most surprising and significant finding is that, despite Telegram's perceived chaos, a natural, emergent organization becomes visible when data is collected and analyzed systematically using Television. Without artificial bundling, communities naturally cluster into modules based on their referral patterns, revealing thematic similarities (e.g., Russian malware discussions, Iranian hacktivism). These clusters are often relatively closed ecosystems, but "bridging nodes" can connect disparate thematic modules, illustrating unexpected interdependencies.

1. Queryable Knowledge Graphs for Actionable CTI: The research points towards the feasibility of building knowledge graphs from the collected data. This allows for the extraction of relationships between entities (e.g., actors, tools, topics, communities) and makes the complex ecosystem queryable and navigable, moving beyond simple data collection to truly actionable intelligence.

Technical Deep Dive

▶ Watch: Test results: Links and timeliness critical for discovery (16:00)

The core of this research lies in the TeleHunt tool and the Television analytical framework, which together provide a structured approach to CTI on Telegram.

TeleHunt: The Discovery Pipeline

TeleHunt is designed for efficient cybercriminal community discovery and operates through a modular pipeline:

1. User Initial Seed Input: The process begins with a user-provided set of "seed" communities. These seeds are manually collected and can originate from various sources, including the dark web, open web aggregators like TG Stat, or even pointers found within traditional cybercriminal forums. The quality of these initial seeds is critical for steering the discovery process towards relevant content.

1. Message Scraping: Once seeds are provided, TeleHunt scrapes messages from these initial communities. This involves interacting with the Telegram API to extract content, including text, links, and forwards.

1. Community Classification: This is a two-stage classification process:

• Cybercriminal vs. Non-Cybercriminal: TeleHunt employs a classifier, trained on a manually curated dataset, to determine if a given community is involved in cybercriminal activities or not. The training data was collected from both known cybercriminal sources (dark web, open web aggregators) and non-cybercriminal Telegram communities.
• Market Segment Classification: For communities identified as cybercriminal, a second classifier assigns them to specific market segments. Examples include cyber attacks, stolen data, or fraud tools. The modular design of TeleHunt allows for adaptation to other use cases, such as hacktivism or other non-economically motivated threat actors, by retraining these classifiers.

1. Pointer Extraction: From the classified messages, TeleHunt extracts pointers to other Telegram communities. These pointers can take several forms:

• Handles: Direct references to public channels (e.g., @channel_name).
• Links: URLs that lead directly to a channel or group. These can be public (t.me/community_name) or private (containing a random hash, e.g., t.me/joinchat/random_hash).
• Forwards: Messages forwarded from one community to another, which inherently advertise the original community.

1. Contextual Analysis for Efficient Discovery: To prevent getting lost in the vast Telegram ecosystem, TeleHunt employs a contextual analysis mechanism during pointer extraction. Instead of blindly following every link, it considers:

• The ad message context: The content of the message itself where the pointer was found.
• Previous messages by the actor: The history of messages sent by the user who posted the pointer.
• Replies to the message: Conversations surrounding the pointer.

This contextual understanding helps in prioritizing and validating pointers, ensuring that subsequent discovery remains relevant to the initial cybercriminal focus.

1. Snowballing: TeleHunt iteratively applies this pipeline. If a newly discovered community is classified as cybercriminal, and the user chooses to continue, its messages are then scraped, classified, and new pointers are extracted, leading to further discovery. This snowballing effect allows for broad and deep exploration of interconnected communities, with the number of iterations being user-configurable.

Link Types and Their Implications:

The research highlights critical distinctions in Telegram link types that impact discovery:

• Public Community Links: These are human-readable (e.g., t.me/community_name), searchable on Telegram, and often associated with a public handle.
• Private Community Links: These are unique, random-hash links (e.g., t.me/joinchat/random_hash), not searchable, and private communities do not have handles. Crucially, the administrator creates these links and can set an expiration time (e.g., 3 days, 7 days). This is why timely pointer extraction is so vital; an old private link will simply lead to a dead end.
• Vetted Community Links: Similar to private links in format, but even after joining via the link, an administrator must explicitly approve the user to read messages or participate. These represent the highest level of access control.

Television: The Analytical Framework

Television is the analytical toolset used to make sense of the vast amount of data collected by TeleHunt. Its primary function is to reveal the emergent structure within the seemingly chaotic Telegram ecosystem.

1. Network Creation: Television constructs networks where nodes represent communities and edges represent referrals (pointers) between them. This is done purely based on the observed referral patterns, without external semantic input.

1. Natural Topic Clustering (Modules): A key finding is that, within these networks, communities naturally form clusters or modules based on their inter-referrals. These modules often correspond to distinct thematic areas or geographical/linguistic groups. For instance, the researchers observed clusters of "Russians that speak about malware" or "Iranians that speak about the war," indicating relatively closed, self-referential ecosystems.

1. Identification of Bridging Nodes: While many clusters are insular, Television can identify bridging nodes—communities that refer to or are referred by communities in different thematic modules. These bridges are crucial for understanding broader interconnections within the cybercriminal landscape, such as a community linking bulletproof hosting discussions in the Russian space to hacktivism groups after geopolitical events.

1. Knowledge Graph Construction: Beyond network visualization, the ultimate goal of Television is to build queryable knowledge graphs. This involves extracting entities (e.g., actors, malware names, tools, TTPs) and relationships between them from the messages and community metadata. This transforms raw data into a structured, semantic representation that can be queried to answer specific intelligence questions, allowing practitioners to navigate the ecosystem, identify relevant actors, and understand their involvement across various criminal spaces.

Demo / Proof of Concept

▶ Watch: Television: Discovering emergent structure in Telegram communities (21:00)

The talk did not feature a live, interactive demonstration of TeleHunt or Television in operation. Instead, the speakers presented the methodology and results from various test runs conducted as part of their research, which served as the proof of concept for their approach.

One specific test run involved three iterations of the TeleHunt pipeline, utilizing different configurations of initial seeds and pointer types. The configurations were denoted by:

• D: Seeds obtained from the dark web.
• O: Seeds obtained from the open web.
• L: Configuration included links for snowballing.
• No L: Configuration did not include links.

The results clearly demonstrated the efficacy of including links:

• Configurations that did not include links (D and O without L) quickly led to dead ends and stagnated discovery.
• Configurations that did include links (DL and OL) showed the highest discovery rate, the highest yield of new communities, and maintained stable precision in identifying relevant cybercriminal content. The speakers specifically noted that links had an exponential influence (a factor of 2.24) on the number of communities discovered.

Further analysis of these test runs revealed that a significant cause of dead ends and wasted API calls was the timeliness of pointer extraction. Many private Telegram links are configured by administrators to expire after a short period (e.g., 3 or 7 days). If TeleHunt attempted to resolve older links, they would often be inactive, highlighting the need for rapid processing.

The test runs also provided insights into the types of communities discovered. The majority were public communities, accessible via search or standard links/handles. However, a notable number of private communities (accessible only via unique hash links) and a few highly restricted vetted communities (requiring admin approval) were also found, including some in Iran. The overall low rediscovery rate across these runs suggested that the Telegram cybercriminal ecosystem is vast, fragmented, and continuously expanding, with no clear saturation point reached.

While not a live demo, the researchers presented visualizations from Television, illustrating how the analytical framework reveals emergent structure from the collected data. These visuals showed clusters of communities forming "modules" around specific topics (e.g., Russian malware, Iranian political movements), demonstrating how the system can automatically map thematic similarities and identify bridging nodes between these otherwise disparate groups. This effectively proved that their careful data collection and analysis method could indeed extract meaningful organization from the Telegram chaos.

Defensive Implications

▶ Watch: Q&A: Forums provide excellent seeds for Telegram hunting (28:00)

The research presented by the Eindhoven University of Technology team offers several critical implications for CTI practitioners and security defenders:

1. Adopt Sophisticated Discovery Methods: Relying on simple keyword searches or manual exploration of Telegram is no longer sufficient. Defenders must adopt structured, automated discovery tools like TeleHunt that leverage contextual analysis and iterative snowballing to efficiently map the cybercriminal landscape. This moves beyond passive monitoring to active, intelligent exploration.

1. Prioritize Timely Pointer Extraction: The ephemeral nature of private Telegram links necessitates a rapid intelligence cycle. CTI teams should aim for near real-time extraction and processing of pointers to avoid wasted resources on expired links. This may require continuous scraping operations rather than periodic sweeps.

1. Leverage Cross-Platform Intelligence: The finding that forums often point to Telegram channels is crucial. Defenders should integrate intelligence from traditional cybercriminal forums as valuable seed data for initiating Telegram discovery. This multi-platform approach creates a more comprehensive understanding of threat actor networks.

1. Understand Ecosystem Fragmentation and Expansion: The low rediscovery rates and lack of saturation indicate a vast, fragmented, and constantly expanding ecosystem. Defenders should recognize that a complete mapping is unlikely, requiring continuous monitoring and adaptation of discovery strategies. Focus should be on identifying key clusters and bridging nodes relevant to their specific threat models.

1. Utilize Emergent Structure for Actor Characterization: The ability of Television to reveal natural, thematic clusters and bridging nodes is a powerful defensive asset. By understanding these "modules" (e.g., specific malware groups, hacktivist factions) and their interconnections, defenders can better characterize threat actors, understand their collaborations, and anticipate their movements. This enables more targeted threat hunting and intelligence production.

1. Build Queryable Knowledge Bases: Raw data, even if collected efficiently, is not actionable. The emphasis on building knowledge graphs provides a clear path for defenders to transform unstructured Telegram messages into queryable CTI. This allows analysts to quickly answer specific questions about threat actors, TTPs, and tool usage, facilitating faster incident response and proactive defense.

1. Focus on Actionable and Usable CTI: The research group's operational background underscores the need for CTI that is actionable and usable within a SOC environment. Defenders should strive to integrate these advanced discovery and analysis techniques into their existing CTI pipelines, ensuring that the output directly informs detection rules, threat hunting queries, and strategic decision-making.

Key Takeaways

• Telegram is a critical, but exceptionally challenging, source for Cyber Threat Intelligence (CTI) due to its vast, fragmented, noisy, and rapidly expanding nature.
• Efficient discovery of cybercriminal communities on Telegram requires contextual analysis of messages containing pointers (links, handles, forwards) to avoid getting lost in irrelevant data and reduce wasted API calls.
• Links, particularly fresh ones, are the most influential pointer type for discovering new communities, with an exponential impact on discovery rates. Timeliness in extracting these pointers is crucial due to the short lifespan of many private community links.
• Despite the apparent chaos, meaningful structure and thematic clusters naturally emerge within the Telegram cybercriminal ecosystem when data is collected and analyzed systematically, enabling better understanding of actor relationships and topics.
• Cross-platform intelligence is vital; pointers found in traditional underground forums serve as excellent initial "seeds" for navigating and exploring the Telegram landscape.
• Tools like TeleHunt (for discovery) and Television (for analysis and knowledge graph construction) provide a scientific and operational framework to transform raw, noisy Telegram data into actionable and queryable CTI, moving beyond simple data collection.

About the Speaker(s)

The talk "Hunting Cyber Threat Intelligence on Telegram" was presented by Luca Allodi and Roy Ricaldi, who are part of a research group at Eindhoven University of Technology. They were joined in the research by Emmanuele Zambon and Victor Asanache.

Their research group is characterized by a strong operational focus, aiming to produce actionable and usable CTI that can be directly ingested by Security Operations Centers (SOCs). They couple this with inside detection research, emphasizing automation that provides informative and compelling evidence for analysts, often employing a "human-in-the-loop" paradigm for AI methods. Uniquely for a research environment, they run their own commercial SOC, the Eindhoven Security Hub SOC (ESH SOC), which serves as a living lab to test and deploy their technologies and procedures scientifically. They are also establishing a new CTI lab in Den Bosch, focused on translating their CTI research into societal value, providing insights into the threat landscape for broader use.