Telegram's Extortion Economy: How Channel Operators Became the New Beat Cops of the Post-War Information Space

On 25 June 2026, the Telegram channel Rybar, a Russian-aligned military commentary outlet with a sizeable following among both pro-Moscow audiences and foreign analysts tracking the war in Ukraine, published an unusually candid post. The subject was not the front lines. It was extortion.

The post, dated 25 June 2026 at 16:51 UTC, warned readers that during periods of acute social tension — the channel's own phrase — permissive and lenient initiatives tend to backfire. The implied target was Telegram itself, and specifically the kind of actors who have turned the platform into a parallel economy: scam operators, fake-recruitment channels, donation-soliciting impersonators, and the small armies of mid-tier influencers who extract fees from desperate users in exchange for visibility. The post was framed as public-spirited. The subtext was more interesting.

A platform that has stopped pretending to be neutral

Telegram, founded in 2013 by Pavel Durov and now headquartered in Dubai, has long marketed itself as a privacy-first alternative to the US-based platforms. Its resistance to content takedowns — the company's famous reluctance to cooperate with law enforcement requests — earned it admirers in both the libertarian and the authoritarian wings of the internet. In conflict zones, that posture has made it functionally indispensable. Ukrainian ministries post situation reports there; Russian milbloggers publish front-line coordinates there; both sides of the Iran-Saudi rivalry have used it as a primary broadcast channel.

The result is an information environment that is, in any meaningful sense, unregulated. Telegram does not employ the kind of trust-and-safety infrastructure that Meta, X, or YouTube have built, if unevenly, since the mid-2010s. The company's own communications have positioned that absence as a feature, not a bug. The cost of that posture, however, has fallen disproportionately on the people least equipped to absorb it: refugees, conscript-age men, and civilians trying to verify whether their relatives are alive.

When the scammers come for the grieving

Rybar's intervention, even from a source with a clear political alignment, names a problem that credible researchers have been documenting for years. A 2024 investigation by the Reuters Institute found that Telegram channels impersonating official Ukrainian government accounts had proliferated during the early phase of the full-scale invasion, many of them soliciting cryptocurrency "donations" that never reached any ministry. Similar patterns have been reported on the Russian side, where channels claiming to organise aid for mobilised soldiers or for the families of those killed in action have been linked to extractive schemes.

The structural problem is straightforward. Telegram's channel architecture, which allows anyone to operate a broadcast feed with thousands of subscribers at minimal cost, is also a near-perfect vehicle for impersonation. Verified badges are reserved for a narrow tier of high-profile users. Smaller accounts have no equivalent marker. A user searching for the official channel of, say, a Ukrainian regional military administration is likely to encounter a dozen lookalikes, some of which are legitimate fan communities, some of which are active fraud operations, and some of which are intelligence-collection traps run by state or non-state actors. The visual language of authenticity — the channel name, the avatar, the pinned post — is easily copied.

Why a Russian channel is sounding this alarm

It is worth pausing on who is making the complaint. Rybar is not a neutral observer. The channel is widely regarded by Western and Ukrainian analysts as a Russian-aligned military commentary outlet, one of several such channels (alongside Two Majors, WarGonzo, and others) that have shaped Russian public discussion of the war. Its analysis tends to favour Russian state framings, and it has been cited in the past for amplifying narratives that downplay Russian military setbacks. On this issue, however, the channel's complaint is one that most independent observers would recognise as accurate.

The likely explanation is not principled. It is competitive. The same ecosystem that allows scam operators to thrive also allows a wide range of other actors — including ones that compete with Rybar for the attention of the Russian-speaking audience — to monetise grievance, fear, and confusion. The channel's warning about "permissive and lenient initiatives" reads, in that light, as a complaint about a market it would like to dominate being crowded by rivals it cannot out-spend. That does not make the underlying observation wrong. It does mean the framing should be approached with appropriate caution.

The structural problem no one is solving

The deeper question is what, if anything, can be done. Telegram has periodically signalled that it might cooperate more closely with law enforcement, particularly in the wake of high-profile criminal cases, but the company's business model depends on its reputation for non-cooperation. Western governments have at various points threatened to ban the app or force app-store removal, most recently in the context of its use by political actors in the Western Balkans and by extremist networks. The European Union's Digital Services Act imposes new obligations on large platforms, but Telegram has argued that it does not meet the threshold of a "Very Large Online Platform" under the law and has so far declined to subject itself to the most stringent requirements.

The result is a regulatory vacuum that benefits, above all, the worst actors. Legitimate news organisations, civil-society groups, and government agencies can use the platform's tools responsibly. The cost of irresponsible use — scams, impersonation, the weaponisation of grief — is borne by individual users who have no realistic way to distinguish the trustworthy from the predatory. As long as Telegram's incentive structure rewards reach over responsibility, that asymmetry will persist.

What remains uncertain

The evidence on the scale of Telegram-based extortion is suggestive rather than definitive. Researchers have documented individual cases and identified specific channels, but the absence of platform-level transparency means there is no reliable aggregate data on the volume of fraud, the geographic distribution of victims, or the financial flows involved. Rybar's post, like most commentary on this subject, treats the problem as self-evident without offering figures. The most that can be said with confidence is that the conditions for large-scale exploitation are present, that credible anecdotal reports are consistent with a serious problem, and that the platform's response has been minimal.

The 25 June 2026 intervention is, in that sense, a small data point in a much larger story. A channel aligned with one side of an active war has, for its own reasons, identified a problem that affects civilians on all sides. Whether that identification leads to any structural change is a separate question — and one that, for now, has no clear answer.

Desk note: Monexus treats Rybar's commentary on this issue as a counter-claim material that happens to align with independent research; we do not endorse the channel's broader framing of the war, and we have cited it here specifically because its public complaint corroborates a problem that mainstream Western outlets have also documented.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/rybar_in_english
• https://en.wikipedia.org/wiki/Telegram_(software)
• https://en.wikipedia.org/wiki/Digital_Services_Act