Corvus.Sense: real-time cyber threat intelligence from telegram monitoring

Since the start of the full-scale conflict in Ukraine in 2022, Telegram has emerged as the operational backbone for cyber threat actor communication. State-aligned hacker groups, hacktivist collectives, and criminal organizations use the platform to announce targets, coordinate distributed attack campaigns, post breach evidence, and recruit. For defense and government cyber teams, Telegram is not a peripheral data source – it is a primary early warning channel.

The problem is scale and velocity. Hundreds of relevant channels generate thousands of messages per day, in multiple languages, mixing genuine threat signals with noise, propaganda, and disinformation. A team of analysts monitoring this volume manually faces an impossible triage burden. Critical threat announcements – a named government portal targeted for a DDoS wave launching in six hours, a claimed breach of a defense contractor's email server – are routinely missed or identified after the fact.

Corvus.Sense is Corvus Intelligence's answer to this bottleneck: a platform that automates the detection, classification, and structured analysis of cyber threats from Telegram messaging data using Large Language Models, delivering actionable threat intelligence at machine speed.

Why telegram is a primary threat actor channel

Telegram's architecture makes it operationally attractive for threat actors. Public and private channels allow broadcasting to large audiences without requiring recipient registration. Message deletion, channel migration, and the absence of message retention policies at the platform level complicate forensic recovery. The platform's tolerance for anonymity and minimal moderation of politically sensitive content in many jurisdictions has made it the preferred coordination medium for groups operating in contested information environments.

The practical consequence for defense cyber teams is that threat actor communications that once required dark web forum access – with associated operational security burdens – are now occurring in a more accessible but still high-volume environment. Groups like Killnet, NoName057(16), and their affiliated networks have maintained extensive Telegram presences since 2022, using the platform to declare attack targets, claim successful operations, and coordinate volunteer participants in DDoS campaigns against government and critical infrastructure targets across Europe, North America, and beyond.

Monitoring these channels manually introduces three structural problems. First, the volume is incompatible with sustained human attention – a monitoring team cannot maintain consistent coverage across hundreds of channels twenty-four hours a day. Second, the speed advantage is lost – a threat announcement made six hours before an attack is actionable intelligence; the same announcement discovered after the attack is an incident record. Third, manual monitoring produces analyst-dependent outputs: notes, screenshots, informal summaries – not structured intelligence products that can be fed into downstream SIEM and CTI systems.

LLM-based threat classification: from noise to structure

The core technical challenge in Telegram threat monitoring is converting unstructured, multilingual, high-volume message streams into structured threat intelligence. This is where Large Language Models provide a qualitatively different capability compared to keyword-based monitoring or rule-based classification.

Corvus.Sense processes each ingested message through an LLM classification pipeline that assigns threat category labels, sector tags, confidence scores, and geographic scope from natural language content – without requiring the message to contain specific keywords or conform to a known template. A message declaring "We are targeting [organization] for the next 48 hours – join our channel for updates" is correctly classified as a target declaration even if the exact phrasing has never been seen before. The same model handles Russian, Ukrainian, English, and other languages without separate rule sets.

Classification categories include DDoS announcement, breach disclosure, target declaration, active attack coordination, reconnaissance signal, post-attack claim, and recruitment. Each classification carries a confidence score. Messages below a configurable confidence threshold are routed to an analyst review queue rather than processed automatically – the system is designed to escalate uncertainty rather than suppress it.

Following classification, the system performs entity extraction: pulling structured data from the message text – target organization names, IP addresses, domain names, claimed breach records, referenced vulnerabilities, and named attack tools. These entities are normalized and cross-referenced against the platform's knowledge graph of tracked actors, campaigns, and infrastructure. A newly extracted IP address that matches known C2 infrastructure from a tracked actor group is automatically linked to that actor's profile.

Attack chain mapping and actor fingerprinting

Individual threat messages have limited value in isolation. The operational picture emerges from the relationships between messages across time: the reconnaissance signal on Tuesday, the target declaration on Thursday, the active DDoS coordination on Friday evening, and the post-attack breach claim on Saturday. Connecting these events into a coherent attack chain is what converts raw monitoring data into intelligence that supports decision-making.

Corvus.Sense maintains a graph-based attack chain model that links events to campaigns and campaigns to actor profiles. As new messages arrive, the system automatically associates them with existing chains based on entity overlap, actor attribution, targeting patterns, and timing. Analysts see not just the latest message but the full evolution of a campaign – including how long the actor has been active, which other sectors or geographies they have targeted, and whether their activity tempo is increasing.

Actor fingerprinting builds on this longitudinal data. Each tracked hacker group develops observable behavioral patterns: preferred attack days and times, characteristic message templates, consistent target selection criteria, and recurring infrastructure elements. Corvus.Sense maintains actor profiles that capture these patterns and uses them for attribution of new activity – even when a group is operating under a new channel name or using modified message formats.

The timeline visualization presents attack pattern evolution chronologically, allowing analysts to identify escalation patterns before they result in confirmed incidents. A government cyber team can see, for example, that a specific actor group has been escalating its targeting of energy sector organizations in their region over the past three weeks – providing the lead time to brief relevant sector operators and adjust defensive posture.

Cross-sector and cross-geography threat classification

One of the structural limitations of manual Telegram monitoring is that coverage is typically organized by analyst specialization – a team covering the financial sector and a separate team covering critical infrastructure. Threats that cross sector boundaries, or that originate from actor groups targeting multiple sectors simultaneously, fall between monitoring silos.

Corvus.Sense applies sector and geography classification to every processed event, covering critical infrastructure, financial sector, government, telecommunications, energy, and defense. All classifications are visible simultaneously in the console, giving a government cyber team a unified threat picture across sectors that would otherwise require separate monitoring operations. When an actor group pivots from targeting telecom providers to government portals – a transition that happened repeatedly during 2022-2024 campaigns – the shift is visible immediately in the cross-sector timeline.

Geography filtering allows clients to focus on their specific area of interest – a national cyber authority monitoring threats against domestic infrastructure – while retaining access to the broader actor activity picture for attribution and pattern analysis.

Automated executive summary generation

The final processing stage converts the structured threat data accumulated over a reporting period into human-readable executive summaries. These summaries are generated at configurable intervals – hourly situation reports during active campaigns, daily briefs during steady-state monitoring – and are formatted for two distinct audiences.

Technical summaries for SOC analysts and threat intelligence teams include the full event list with confidence scores, entity extractions, actor attributions, and STIX-formatted indicator exports. Executive summaries for senior decision-makers present the same data at a higher level of abstraction: sector threat levels, significant new activity by actor group, recommended defensive actions, and an overall threat trend assessment.

This dual-format output eliminates the manual report-writing burden that consumes significant analyst time in organizations relying on manual monitoring. The same data is available in both formats without additional analyst effort – a capability that becomes operationally significant during active campaigns when analyst capacity is most constrained.

Use case: government cyber team during an active infrastructure campaign

Consider a national cyber authority responsible for monitoring threats against domestic critical infrastructure. In early 2024, an actor group affiliated with a state-aligned hacktivist network begins posting target declarations against energy sector organizations in the country. The declarations appear across four separate Telegram channels, in two languages, over a forty-eight hour period.

With Corvus.Sense deployed, the first target declaration triggers a high-confidence alert within minutes of posting. The system links it to the actor group's existing profile – which shows seventeen prior campaigns against energy targets in neighboring countries over the preceding six months. The attack chain visualization displays the pattern: reconnaissance signals three to five days before each prior attack, target declaration forty-eight to seventy-two hours before attack, DDoS coordination in the final twelve hours.

The cyber authority team receives an automated situation report within the hour, formatted for briefing to sector operators and senior leadership. They have forty-eight hours of warning intelligence – time to alert specific energy sector organizations, coordinate with their CERT, and deploy additional monitoring on the targeted infrastructure. When the attack arrives, the response is coordinated rather than reactive.

This is the operational difference that automated Telegram threat intelligence delivers: structured warning intelligence with sufficient lead time to act, rather than confirmation that an attack occurred.

Integration with existing cyber infrastructure

Corvus.Sense is designed to extend existing cyber infrastructure rather than replace it. The platform exports structured threat intelligence in STIX 2.1 format via TAXII 2.1, making its outputs directly consumable by major SIEM platforms including Splunk, Microsoft Sentinel, and IBM QRadar. High-priority threat alerts are delivered via webhook in real time for integration with SOAR playbooks and automated response workflows.

For government and defense clients requiring classified deployment configurations, the platform can be operated in an air-gapped environment with manual feed export mechanisms – maintaining the structured intelligence output while meeting the operational security requirements of classified networks. The REST API supports custom integrations with existing analyst tooling and reporting infrastructure.

The Corvus.Sense console provides the analyst-facing interface: timeline visualization, actor profiles, attack chain maps, sector threat dashboards, and the analyst review queue for low-confidence classifications requiring human judgment. The console is designed for sustained use during active monitoring operations – not a dashboard that is checked periodically, but a working environment for analysts whose primary function is threat intelligence production.

Frequently asked questions

Related reading: For the broader architecture of a defense cyber threat intelligence platform, see Cyber Threat Intelligence Platforms for Defense. For OSINT monitoring methodology beyond Telegram, see OSINT Threat Monitoring for Defense Organizations. For SIEM and SOAR integration patterns in defense SOC environments, see SIEM/SOAR Integration for Military Cyber Operations.