Now that Pavel Durov has announced that Telegram will hand over IP addresses to law enforcement, are the rats leaving a sinking messaging platform?

Telegram founder and obnoxiously rich person Pavel Durov announced a major change to the messaging platform last week: upon request, the platform will now share its users’ IP addresses with law enforcement agencies around the world .

Durov was arrested last month in France over allegations of lack of moderation on the platform encouraging criminal activity – and honestly, there’s a lot of criminal activity on Telegram, from hacktivists and cybercriminals to drug dealers and other elements of the organized crime.

So now that their safe space is no longer so secure… How will these criminal elements, particularly hackers and their ilk, react?

Well, some are considering leaving the platform altogether.

“Due to growing concerns about data privacy and security on Telegram, we are moving our community interactions to Twitter X, Session and Discord,” Indian hacktivist group and ransomware operator CyberVolk said on its Telegram channel on September 24.

“Telegram is no longer secure because it can compromise your private data.”

The group appears to have deleted their channel a few days after posting this message.

Prolific DDoSers and Russian hacktivist group Killnet shared their thoughts on the decision to share IP addresses as well as Telegram’s decision to provide AI-based content moderation in Telegram’s search function.

“On the one hand, you might think it’s cool. But we are getting closer and closer to the ideology of Instagram\WhatsApp\Facebook… whose ideology is not at all based on anonymity, an orientation that Pasha [Durov’s nickname in his hometown of St Petersberg] has emphasized since the launch of Telegram,” Killnet said in a September 25 post on Telegram.

“Anonymity for whom, I would like to ask. For journalists, whose numbers are already not difficult to find? For military channels that are of no use to anyone anyway? To exchange nude photos that can already be sent in other messengers?

The Killnet spokesperson noted that “everyone understood what audience Telegram was attracting with its anonymity slogans” – namely hackers and other criminals – before offering advice on how to continue using the platform in stay safe and other tips to avoid police control.

According to data intelligence firm Flashpoint, the platform’s cybercriminals are reaching similar conclusions.

“Threat actors are flocking to Telegram to communicate and coordinate all kinds of illicit activities. The announcement that Telegram will now provide certain user data to authorities has shaken the world of cybercrime. Criminal and extremist groups fear losing their safe haven, which is why Flashpoint is already seeing active discussions about the need to find alternative platforms,” said Flashpoint Chief Intelligence Officer Tom Hofmann.

“If Telegram openly cooperates with law enforcement, we expect malicious actors to split. Expect a near-term migration to other social platforms like Discord, Signal, and Matrix, although most will likely return to Telegram for centralized messaging purposes.

Which seems to be pretty much what ransomware-as-a-service operator Stormous is doing. In recent days, the group had to create a new Telegram channel, citing “the closure of our previous channel by certain entities”.

“However, this is not a problem and will not affect any of our operations. We will now focus entirely on our sites on the Tor network,” Stormous said in a September 26 post, upon the creation of his new channel.

“Telegram will simply serve as a gateway for certain people to learn about our latest victims or access our RaaS services.”