Extortionists Plant CSAM to Get Telegram Banned

What happened

Telegram's CEO alleged that an extortionist planted child sexual abuse material (CSAM) into a public group chat in order to get the app briefly removed from Apple's App Store. Rather than posting new illegal content that moderation systems and members would quickly catch, the attacker reportedly edited an older message in an active chat to insert the material. This made the content effectively invisible to group members, since edits to old messages don't surface the way new posts do.

The extortion mechanism

According to Telegram, the actors behind this tactic use automated accounts to plant illegal content in public groups and then report it directly to Apple, attempting to trigger removal of legitimate communities whose owners refused to pay them. The stated goal is ransom: group owners are pressured to pay to avoid being targeted this way. This turns a platform's own enforcement and reporting channels into a weapon against the very communities they're meant to protect.

Why it succeeded

The technique worked around normal safeguards in a few ways:

• Editing an old message avoided the scrutiny that new posts typically receive from both members and automated moderation tools.
• Automated accounts could plant content and file reports quickly, without relying on human coordination that might be noticed.
• The report was routed to an external party (Apple's App Store review process) rather than staying inside Telegram's own moderation pipeline, adding pressure through a channel the group owner doesn't control.

What to watch for

Community managers, moderators, and trust and safety teams should be alert to:

• Ransom or extortion demands tied to threats of platform or app store takedown
• Unexplained edits to older messages in high-traffic public groups
• Enforcement actions or removals tied to content that members say they never saw
• Suspicious or newly created automated accounts interacting with old posts

Building resistance

Organizations that run public communities should treat this as a real social engineering and extortion risk rather than a one-off technical glitch. Recommended steps include escalating any ransom demand tied to a takedown threat directly to legal and trust and safety teams instead of negotiating, monitoring for suspicious message edit activity, and maintaining a rapid response plan for platform or app store enforcement events. That plan should define who investigates, how evidence is preserved, and how the organization communicates with members and platform partners like Apple during an incident.

How did extortionists get Telegram removed from the App Store?

According to Telegram, an attacker planted child sexual abuse material by editing an old message in an active public group, then reported the group directly to Apple to trigger removal.

Why didn't group members notice the illegal content?

The attacker allegedly hid the content by editing an older message in the chat, which kept it from appearing as new activity that members would see or report themselves.

What is the extortion angle in this attack?

Telegram claims the threat actors demand ransom from group owners in exchange for not targeting their communities with this planting-and-reporting tactic.

What should community managers do about this threat?

Treat ransom demands tied to platform takedown threats as a real risk, escalate to legal and trust-and-safety teams, and watch for suspicious edits to older messages.