Telegram Crackdown Contained Threat Actors but Did Not Displace Them
Summary
A Check Point executive says Telegram removed over 43 million channels and groups in 2025, but criminal actors quickly returned using gated access, backup channels and hybrid communications; he urges continuous, contextual monitoring.
Key points
- The article reports that more than 43 million Telegram channels and groups were blocked in 2025, while some threat actors reportedly reappeared within days.
- It says actors used request-to-join gating, backup channels and compliance disclaimers to adapt to moderation.
- The author describes Telegram as the main broadcast and coordination platform, with some sensitive exchanges shifted to other platforms or private conversations.
- The article says Telegram invite links appeared far more often in its tracking of underground forums and marketplaces than links to competing messaging platforms.
- It recommends continuous monitoring, contextual intelligence and rapid remediation to connect Telegram activity with organizational risk.
Article Details
- Topic
- Telegram moderation and threat actor adaptation