SayakSR/DarkGram: v1.1

Repository for the paper "DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram"

This paper introduces DarkGram, a comprehensive framework designed to analyze and mitigate cybercriminal activity on Telegram. Our work presents the first large-scale study of 329 malicious Telegram channels, followed by over 23.8M users, which shared 53,605 posts containing a wide array of malicious and unethical content with their subscribers, including compromised credentials, pirated software and media, social media manipulation tools, and blackhat hacking resources such as malware and exploit kits, and social engineering scams.

The primary objectives of this research were to characterize the nature of the content shared in these channels, assess the risks it poses to their subscribers, and develop a robust automated system to detect and report such channels proactively. To achieve these goals, we trained a BERT-based classifier on an annotated corpus of posts, enabling DarkGram to detect malicious content with an accuracy of 96%. Over a three-month period, this framework identified and reported 196 new channels, leading to their subsequent takedown, thus demonstrating DarkGram’s tangible, real-world impact. We further contextualized our findings by comparing this emerging ecosystem with traditional cybercriminal forums, highlighting how Telegram has evolved into a powerful platform for distributing illegal and harmful content.

The artifact focuses on making the DarkGram framework available to the research community. Towards this goal, we make available the full dataset used in our study, scripts for annotating the data, resources for training the detection classifier, and also implement the real-time DarkGram system. Through this release, we aim to facilitate further investigation into Telegram-based cybercrime and encourage collaborative efforts to combat such activities.

Please read the README.pdf file for more information, as well as directions on how to use this artifact.