Telegram under scrutiny: spain battles cybercrime hub

Spain is grappling with a growing regulatory clash over Telegram, the messaging app’s popularity fueling concerns about illicit activities. The Spanish government’s direct confrontation with Telegram CEO Pavel Durov highlights a widening chasm between platform innovation and security accountability.

Spain tightens grip on telegram amidst cybercrime surge

The tension escalated earlier this year when Durov himself warned users that social media regulations amounted to a “state of surveillance.” This isn't new; Telegram has previously faced copyright challenges. But 2025 saw the platform become a key facilitator of fraud in Spain, accounting for 22% of financial crime, according to Revolut data. The government is now deploying tools like HODIO, designed to measure online hate speech, adding further pressure.

While Telegram boasts end-to-end encryption, this very feature enables cybercriminals to establish underground marketplaces, seemingly legitimate groups, and fake accounts, all designed to ensnare victims. A recent investigation by Check Point Software reveals that despite Telegram's increased efforts to combat cybercrime, it remains a prime target for malicious actors. “Ignoring criminal activity on Telegram creates critical blind spots that attackers will continue to exploit,” the report states. Security operations centers (SOCs) must now view the platform as a vital area for brand protection and early threat detection.

Daily channel closures have reached a record 500,000, a dramatic increase from the previous norm of around 10,000. Even with record compliance rates, 20% of blocked channels were linked to carding operations, personal data trading, and illegal hacking services. “These efforts have increased operational friction but have not eradicated the presence of cybercriminals, who demonstrate a capacity for adaptation that exceeds the response capabilities of platforms,” Check Point's report argues. Over the last three months alone, the firm’s threat management team has tracked 3 million invitation links to Telegram shared in clandestine environments.

Compared to competitors, Telegram’s dominance in criminal activity is stark. Discord accounts for less than 6% of similar links, while Signal, SimpleX, and Matrix show minimal activity. Telegram remains the central nervous system for cybercriminals. If moderation efforts were truly driving users elsewhere, a clear migration would be evident – it isn't.

The sheer volume of blocked channels underscores the scale of the problem. Telegram’s efforts to curb criminal activity are clearly insufficient to stem the tide of illicit operations leveraging its features. The platform’s continued prominence as a hub for cybercrime presents a significant challenge for law enforcement and cybersecurity professionals alike.

The ongoing struggle between Telegram, regulators, and cybercriminals is a stark reminder of the evolving battleground for online security. The platform's architecture, designed for privacy, has inadvertently created a haven for malicious actors, and its ability to adapt will determine its future.