A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
Researchers detect cybercrime infrastructure-as-a-service ads across more than one million Telegram messages.
The paper introduces a taxonomy for Telegram messages advertising cybercriminal infrastructure-as-a-service, with six categories spanning compute, network, and communication services and trust attributes for Bulletproof hosting, payment security, and transparency. After testing keyword, TF-IDF, and exploratory LLM classifiers on 261 annotated messages, the authors apply TF-IDF to 1,116,071 messages from 167 communities. It assigns an infrastructure category to 207,244 messages (18.57%) across 113 communities; one community accounts for 50.3% of positives, and Bulletproof claims appear in 37.66% of them.
- Taxonomy covers six infrastructure categories and three trust attributes.
- TF-IDF labeled 207,244 of 1,116,071 messages, or 18.57 percent.
- One community accounted for 50.3 percent of positive messages.
- Bulletproof claims appeared in 37.66 percent of those ads.
- Products
- Telegram
From the original article
1 min read at arxiv.orgCybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS).
By Roy Ricaldi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.