- Confidential and Proprietary -
Luminar Annual Threat Landscape Report Page 23
and sales of breached data. Comparing the numbers of posts offering leaked records on Telegram and
the Dark Web shows that starting in 2021, Telegram toppled the Dark Web platforms. Both in 2021
and 2022, the volume of messages sharing leaked records on Telegram is approximately double the
number of posts on the Dark Web.
Graph 5 – The number of shared leaked records in Telegram and the Dark Web
While we can see the huge amount of data leaks shared on Telegram, it is important to remember
that sometimes the numbers do not tell the whole story. Looking into the data itself, we can see that
most of data leaks shared on Telegram are what is known as ‘Combolists,’ lists of emails and passwords
that were scraped from various sources. In many cases such data is recycled, taken from previous leaks
that were published on both Telegram and the Dark Web. However, unlike the ‘Combolists’ on
Telegram, the data leaks shared on Dark Web sources are databases of specific websites or platforms
that were hacked. Despite the large quantity of data leak messages on Telegram side, Dark Web
sources, while amounting to fewer messages, still offer “better quality” data leaks and breached
databases.
The sale of network access has become increasingly popular in recent years and offers of access
credentials appear on both Dark Web platforms and Telegram. As seen in Graph 6, between 2019-
2022, cybercriminals have preferred to use the Dark Web to post offers on access to networks.
0
5,000
10,000
15,000
20,000
25,000
30,000
35,000
40,000
45,000
50,000
2020 2021 2022
Telegram Dark Web