Detecting cybercrime infrastructure ads on Telegram with text classifiers
A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
Cryptography and Security
Summary
Cybercriminals often rent digital tools like servers and proxies through online markets and promote them on platforms such as Telegram. The authors created a way to identify Telegram messages that advertise these services, categorizing types of infrastructure and assessing trust features like payment security. By training and testing text classifiers on labeled posts, they applied their best method to over a million Telegram messages and found that advertisements are highly concentrated in a few communities. This approach helps highlight where and how cybercriminal infrastructure is being sold online.
What this means in practice
- •For cyber threat analysts: Identify and prioritize Telegram communities advertising cybercrime infrastructure for targeted monitoring and investigation.
- •For law enforcement cybersecurity units: Focus resources on Telegram groups heavily promoting bulletproof hosting and other illicit infrastructure to disrupt criminal services.
Authors
Roy Ricaldi, Kristiyan Kyurkchiev, Irdin Pekaric
Abstract
Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS). The taxonomy comprises six service categories across compute, network, and communication infrastructure, together with three trust attributes: Bulletproof, Payment Security, and Transparency. Using 261 human-annotated messages, we evaluate keyword-based and TF--IDF classifiers and examine prompt-based large language models as exploratory baselines. We select a TF--IDF pipeline and apply it to 1,116,071 messages from 167 cybercrime-related Telegram communities. The pipeline assigns at least one infrastructure category to 207,244 messages (18.57%) spanning 113 communities. Classified advertising is highly concentrated: a single community accounts for 50.3% of infrastructure-positive messages, while the trust-attribute classifiers identify Bulletproof claims in 37.66% of those messages. These findings characterize the scale, composition, and concentration of infrastructure advertising on Telegram and can inform the prioritization of communities and actors for monitoring and investigation.