Acting on the National Testing Agency’s (NTA) recommendations, India temporarily blocked the Telegram messaging app from Jun 16 to 22.
The NTA said the ban was “in response to the organised use of the platform by cheating rackets to defraud candidates” ahead of the re-examination on Jun 21.
Telegram challenged the temporary ban, but a New Delhi court upheld the government’s decision, ruling that the restrictions were legal and reasonable.
For investigators and cybersecurity researchers, the NEET controversy was only the latest example of a larger trend. Telegram has become a recurring feature in India’s cybercrime investigations.
“What began as a communication tool is now an alternative to dark web forums,” said Shobhit Mishra, a threat intelligence researcher at CloudSEK, an Indian firm that monitors cybercrime ecosystems.
Threat actors use Telegram as command-and-control infrastructure for malware, a marketplace for selling compromised data, and a platform for large-scale phishing and fraud campaigns in India, said Mishra.
As governments across Asia grapple with the criminal misuse of messaging platforms, India’s response also raises broader questions about whether platforms like Telegram have become critical infrastructure for organised cybercrime and what governments can realistically do about it.
TELEGRAM UNDER THE SCAM SPOTLIGHT
Researcher Mishra explained that whether a threat actor is selling leaked exam papers, pushing a fake crypto investment scam or distributing pirated software, they need three things: mass reach, anonymity and automated interactions.
“Telegram provides all three out of the box, making it the most versatile tool available to modern cybercriminals,” he added.
Telegram’s publicly searchable channels, anonymous usernames, automated bots, large groups that allow up to 200,000 members, and 4 gigabytes file-sharing limit make it useful for criminal networks, according to CloudSEK.
These features are routinely exploited to automate phishing campaigns, credential theft and malware operations.
Telegram disputes that characterisation.
“Cybercrime can and does happen on every digital platform,” the company told CNA in a written statement.
“It is categorically wrong to claim that Telegram is a piece of infrastructure for a problem that is endemic to the internet itself.”
The company said its features “are not built to facilitate crime and provide no advantages for it”, adding that many have since been adopted by other platforms including WhatsApp and Instagram.
Investigators also point out that Telegram is often only part of the fraud chain.
Victims are often first contacted through WhatsApp messages or Facebook advertisements before being moved to Telegram, where organised fraud networks coordinate the operation, said Shubham Singh, a cybersecurity expert who works with Indian law enforcement on digital crime investigations.
Singh said the victims vary, but the mechanics are often similar.
Read the full article here
