A “Signal” to Leave – Criminals’ Response to Telegram’s CEO Arrest
Blog

A “Signal” to Leave – Criminals’ Response to Telegram’s CEO Arrest

posted by

Tasha Elysee

Introduction

  • On Saturday, August 24, 2024, Telegram’s CEO and founder, Pavel Durov, was arrested in France for allegedly failing to moderate criminal activities taking place on the platform, citing organized crime, drug trafficking, fraud, and the distribution of pornographic images of minors.1
  • Telegram was founded in 2013; however; during the last few years, fraudsters and cybercriminals alike have been drawn to the popular messaging app due to its anonymity and unenforced content moderation.
  • Durov’s arrest has left fraudsters and cybercriminals unsettled, some worrying about the future of the messaging app. Some threat actors fear this may disrupt their illicit activities and the chatter centers on contingency plans to continue their operations elsewhere
  • There is abundant chatter regarding moving to other platforms, such as Signal, either as a “back up” or as a full migration. As a result, many threat actors have already been sharing their Signal invite links to their subscribers/members on Telegram. Another platform mentioned was Matrix.
  • Since the arrest was made public, we observed over a 9,000% increase in the number of Signal links shared compared to the average before.
  • Russian-speaking and some sophisticated cybercriminals vouch against using Signal and suggest other messaging alternatives, with Matrix2 being the most prominent among them.

Background

Telegram is a messaging app launched in 2013 by brothers Pavel and Nikolai Durov. It gained popularity for its strong focus on privacy and security, offering features such as end-to-end encrypted messages (aka secret chat), large groups and channels, and self- destructing chats.3 Although many use the platform for legitimate purposes, it has also attracted many who use it to engage in various illegal activities on an international level. The motivation for the French government’s arrest of Durov was due to the platform’s absence of responsibility to curb illicit behavior on the app.4

Threat Actors’ Reaction

Pavel’s arrest has prompted fraudsters and cybercriminals to question the future of the platform, sharing their concerns of the application’s rumored shutdown, data shared with authorities, and the curbing of illicit operations. Although some fraudsters disregard the idea of a supposed shutdown, many fraudsters have expressed apprehension regarding the platform’s longevity due to the fear that Durov will cooperate with law enforcement.

Members of different groups questioning their peers if they think Telegram will shut down.
Members of different groups questioning their peers if they think Telegram will shut down.
Other fraudsters announcing in different Telegram groups that it is shutting down.
Other fraudsters announcing in different Telegram groups that it is shutting down.
Fraudster expressing that he would lose business if Telegram were to get deleted.
Fraudster expressing that he would lose business if Telegram were to get deleted.

Signs of a Migration

In response to both the arrest and fear of Durov cooperation with authorities, there is also an increase in chatter about migrating onto alternative platforms such as Signal or Discord. There seems to be a preference for Signal as Discord may be “risky”. As a result, threat actors have created groups on Signal and are using Telegram to share the Signal invite links with their existing members/subscribers in announcing their migration from the platform. Signal is another messaging app that offers end-to-end encryption similar to Telegram.5

Fraudster stating he’s moving to a new app.
Fraudster stating he’s moving to a new app.
Another example of a cybercriminal moving their business operations to the alternative app Signal.
Another example of a cybercriminal moving their business operations to the alternative app Signal.

The Russian-speaking cybercriminal community has a different opinion on alternative platforms of choice. At the moment, there is no consensus on which alternative messenger to use. However, there is consensus that Signal should not be trusted, as it was developed in the United States. Moreover, these concerns are voiced not only by Russian-speaking threat actors (see the screenshot below).

Some suggest returning to the use other apps

Some suggest returning to the use of Jabber6 and qTox7, while others propose using Matrix as an alternative to Telegram.

A Russian-speaking threat actor speaks out against Signal and suggests using Matrix.
A Russian-speaking threat actor speaks out against Signal and suggests using Matrix.

What’s Next?

With Telegram’s future unknown, threat actors do not appear to be taking risks when it comes to maintaining their illicit business operations or avoid losing business. Out of an abundance of caution, fraudsters are setting up shop on other platforms such as Signal, while others are exploring or promoting alternative platforms. At this point, it is premature to determine whether a large-scale migration from telegram will indeed materialize and if so, which platform or platforms will emerge as the winners. We will continue to monitor these developments in real time.

1https://www.cnbc.com/2024/08/26/who-is-telegram-founder-pavel-durov-and-why-was-he-arrested.html
2https://matrix.org/
3https://www.the-sun.com/news/12283508/telegram-founder-pavel-durov-arrested/?utm_source=native_share&utm_medium=sharebar_native&utm_campaign=sharebaramp
4https://www.cnbc.com/2024/08/26/who-is-telegram-founder-pavel-durov-and-why-was-he-arrested.html
5https://signal.org/
6https://www.jabber.org/
7https://qtox.github.io/
  • Aug 11, 2026

    The Silence Layer

    Read More
  • Jul 30, 2026

    From Zero Click to Full Access

    Read More
  • Jun 25, 2026

    Webinar When Live Isn’t Live

    Read More