The brief removal and restoration of Telegram from the App Store was a targeted attack by a "takedown extortionist," and it's something the company's CEO says can be weaponized against other apps, too.
On Monday evening, Telegram was removed from the App Store for a number of hours, following a report that CSAM material was posted to it. The following day, the fallout of the event revealed it was a worse situation than first thought.
It apparently wasn't a user, but someone weaponizing Apple's policies against the app's users.
Posted to X on Tuesday, Telegram founder and CEO Pavel Durov writes that a user was a "takedown extortionist" who would demand ransoms from group owners; otherwise, they would perform actions to take the group down.
The extortionists would then use automated accounts to post illegal pornographic content to the group and report the existence of said material to Apple. All in an attempt to force moderators into removing the group.
While Durov claims the moderation on Telegram is "effective," the attackers turned to technical tricks to hide the content. This included backdating the content, making it "effectively invisible" to the moderators, making it much harder to spot.
To Durov, there are two lessons for developers and online communities from the experience.
First, extortionists are now able to "manipulate Apple into overreacting," with Apple removing Telegram before contacting the app. "If an app used by more than a billion people can be removed from the App Store without prior warning, any app can be," he warns.
Secondly, the tactics by extortionists are "evolving." While Telegram has experience with identifying coordinated reporting attacks, "Other platforms may not be equally prepared."
