Illicit Messaging Activity

What is illicit messaging activity?

Messaging platforms have become a common place for threat actors to coordinate, advertise stolen data, and sell access to compromised networks. Illicit messaging activity refers to any reference to your organization’s public IP addresses or domains surfacing in these channels. Because the people reading them are actively looking to buy, exploit, or build on what’s posted, a mention here can be an early signal that something involving your organization is already circulating, often before it would reach your security team through any other channel.

Why messaging channels, specifically

The dark web itself carries a natural barrier to entry: reaching it takes a specialized browser, knowledge of ever-changing addresses, and forums that come and go. Messaging platforms like Telegram lower that barrier: content spreads quickly through forwarding, conversations move faster than forum threads, and channels can be easy to find and join. That combination has made messaging channels a preferred venue for some of the same activity once confined to forums: initial access sales, stolen credential dumps, and coordination around upcoming attacks.

What shows up in illicit messaging channels

1. Access and credential sales - Sellers advertise network access, VPN credentials, or admin panel logins, sometimes naming the organization or industry to attract buyers.
2. Vulnerability and exploit discussion - Channels discuss newly disclosed vulnerabilities and working exploits well before most organizations finish patching.
3. Coordination and planning - Some channels are used to organize distributed attacks or recruit participants, occasionally referencing specific targets.

A platform’s own scrutiny doesn’t stop the activity

Messaging platforms can face real consequences for how they moderate illicit activity. French authorities opened a criminal investigation into Telegram’s own leadership in 2024 over the platform’s alleged role in enabling criminal activity. But enforcement against a platform doesn’t retroactively remove the activity that already took place on it, and it rarely stops similar activity from continuing on the same platform or moving to another one.

Monitoring illicit messaging channels

Watching messaging channels directly means tracking groups that can be deleted, renamed, or made invite-only without notice. Services such as ThreatHarvest monitor illicit messaging channels, specifically Telegram, for references to the public IPs and domains an organization registers, so a mention becomes a finding instead of something surfacing only after the fact.