Cybercriminals are taking advantage of the messaging platform Telegram by creating channels and groups where learning and commerce all can take place freely.
We’ve long known the dark web to be the back shadowed corner of the Internet where cybercriminals go to do business. But we’ve seen more examples of marketplaces frequented by threat actors shifting to the open web. One of the latest is the continued misuse of messaging platform Telegram. We’ve previously seen it used as a tool during phishing attacks to create messages to send to victims.
But the latest iteration of Telegram’s use is that of a marketplace. According to security researchers at Guard.io, Telegram channels and groups are becoming a central repository for everything from training courses, to malicious tools and services for sale.
Read the Guard.io article – it shows a very practical scenario of a “cybercriminal” (in this case, Guard.io researchers) wanting to launch a phishing campaign. They walk through how they are able to find and negotiate pricing on all the tools, data sets and services necessary to impersonate a national bank and potentially scam customers – all for just $230.
This dangerous combination of dark web-style content being made on the open web is akin to thieves, hustlers, carjackers, etc. all meeting in an open lot in a city for all to see and no one is doing anything to stop them.
This are going to get increasingly worse.
It also means the burden of stopping such attacks is inevitably going to rest with the recipient user of such phishing attacks, as we already know a percentage of attacks make it past solutions. So users are going to need to be prepared with security awareness training so they can maintain a sense of vigilance that may be the only thing protecting them against a potentially perfect phishing attack.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Here's how it works:
