Darinka Aleksic
It has become painfully clear to cybersecurity analysts that Telegram has become the primary infrastructure for distributing infostealer logs. That reality would be bad enough if infostealer logs represented the full extent of the problem. But they do not. Telegram facilitates another massive dark economy: unadulterated financial fraud.
Telegram is not just an encrypted chat app to a modern cyber threat actor. It is also a completely unregulated, global e-commerce marketplace rife with fraud potential. Among the most lucrative commodities traded on Telegram are stolen gift cards and something known as ‘Fullz.’
Defeating established fraud networks requires more than just looking at standard network perimeters. Enterprise security teams must integrate targeted Telegram fraud monitoring directly into their active threat intelligence pipelines.
Understanding the Commodities Is Critical
DarkOwl is a threat intelligence provider and expert on cyber threat actors. They explain that security teams can’t sufficiently defend against Telegram fraud if they do not understand the commodities being bought and sold on the platform. Here is a brief explanation of the two previously mentioned commodities:
- Fullz Reselling – ‘Fullz’ is slang for a comprehensive and structured package of personally identifiable information (PII). A Fullz set includes everything a cybercriminal needs to completely assume a victim’s identity: Social Security number, billing address, mother’s maiden name, and more.
- Gift Card Reselling – Gift card reselling begins as ‘carding’, the practice of using stolen credit card information to bulk-purchase retail gift cards. Some hackers rely on automated bots to steal unredeemed gift card balances. The new cards and existing balances are then sold on Telegram at heavy discounts.
DarkOwl explains that both crimes are fairly easy to commit. Gift cards lack strict regulatory control, for example, making them a foolproof way to both generate revenue and launder revenues earned through other illicit activities.
Telegram Fraud Monitoring: The Need Is Real
Understanding the commodities clearly reveals the need for Telegram fraud monitoring. Organizations relying on reactive fraud alerts are already multiple steps behind. Why? Because by the time a merchant actually processes a fraudulent transaction, the money is already gone.
DarkOwl says that incorporating Telegram fraud monitoring shifts the workflow from defensive and reactive to aggressive and proactive. Security analysts can build a robust anti-fraud framework by focusing on two integration points:
- Brand and Asset Tracking – Monitoring tools should be configured to continuously scan for specific keywords across as many channels as possible. They should be looking for brand names along with terms like ‘gift card’ and ‘digital code.’ Scanning for bank identification numbers is also a must.
- Parsing and Ingestion – Telegram marketplaces are heavily dependent on automated checkout bots. Advanced threat intelligence practices take advantage of this by deploying scrapers to ingest bot feeds and messages. Ingested data can then be parsed into structured threat intelligence information.
The main thrust of Telegram fraud monitoring is to stop the fraud before it happens. Doing so is not easy, but ignoring the fraud isn’t an option either.
A Final Word About Threat Actor Profiling
Telegram’s widespread reach and unregulated nature can make detecting fraud a lot like finding a needle in a haystack. But threat actor profiling can help. Cyber threat actors are creatures of habit.
So by building comprehensive profiles of known threat actors, security analysts can track them more closely. They can also adapt their defensive strategies to ward off potential attacks before they begin.
Telegram is quickly becoming an enormous problem for security analysts and IT teams. One of the biggest concerns right now is the outright financial fraud the platform facilitates. Unfortunately, that means Telegram monitoring is no longer optional.
