Behind Closed Channels: The Firearms Black Market on Telegram

In the UK, the possession and purchase of firearms is heavily regulated with people needing a certificate from the police. Applications can be made to acquire licensing, however, to be granted a license a “good reason” and strong justification that the firearm will not endanger public safety are a couple of the requirements. Exceptions to licensing can include air rifles, air pistols, and firearms used in sporting events; although legal, are still bound by strong regulations. The strict laws that govern firearms within the UK are highly likely a reason for the lower levels of gun deaths compared to other countries. Across 2022 to 2023, shootings contributed to 4.9% of homicides in the UK in contrast to 76.37% in the US.

However, in August 2024, an individual attempted to purchase a gun using a counterfeit license which they heavily researched into forging. On 12 September 2024, the individual successfully purchased a shotgun and ammunition for £650 from a legal private seller. The firearm was used as a weapon in a violent crime with the individual having planned to use the gun in a school shooting too. Although successful in acquiring a gun, the individual had to make two attempts and gather resources to enable his purchase.

UK street crime sees the use of illegal firearms in gang fights, armed robberies, and drug distribution. An example of illegal firearm use was a drive-by shooting in London, which happened on 29 May 2024. It was believed to be a result of an ongoing feud between two rival gangs in London over the control of the UK’s heroin trade. Moreover, in recent shooting cases, illegal firearm usage can be seen taking place in residential streets, for example on 20 March 2025, and 29 April 2025. The London shooting showcases firearms as a weapon choice in UK gang turf wars.

The CYJAX Open-Source Intelligence (OSINT) team recently conducted research into the sales and advertisement of firearms on the instant messaging platform Telegram. We explored the current customer base of vendors, current demand, and an increase in vendors seeking to courts UK-based audiences.

Whilst Telegram has been used by threat actors in recent years to sell drugs, fraud services, and weapons, in recent months, CYJAX analyst found a sharp rise in the number of threat actors advertising and supplying firearms on Telegram recently. Telegram is a platform used to conduct such illegal activities as opposed to the dark web marketplaces. This is because Telegram is more accessible and far more convenient to the everyday person whereas access to the dark web requires stricter Operational Security (OPSEC) and the know-how to remain anonymous. OPSEC measures for the dark web could include using a VPN, setting up a virtual machine, and having knowledge on random onion addresses. Whereas Telegram can be used on-the-go, like other social networking apps, since it can be run on mobile phones and has features to voice call, text messages and share media or files. In the age of social media, Telegram, which was made to be private, can be the more ideal platform to host and access illegal services.

Figure 1

Figure 2

It appears that vendors particularly target certain regions as opposed to globally due to supply. In the US, CYJAX’s analyst team identified that threat actors claim to have AR-15 platform rifles and Glock Pistols as demand for such firearms in North and Central Americas is the highest.

On the other hand, European vendors typically seek to specialise in the supply of Kalashnikov copies and variants from Eastern Europe or China. In some cases, threat actors have also been found re-activating pistols such as de-activated Turkish Retay pistols and offering them for sale to would-be customers. Whilst AK variants are the most common for sale, typically smuggled from Eastern Europe or North Africa, threat actors do offer other modern weapons made in Western Europe such as FN, and Heckler & Koch weapons.

In the Middle East, CYJAX found vendors offering a diverse selection of weapons for sale, from full sized rifles to RPGs. Unlike in Europe, users are admitted into a nationwide group chat, where vendors can compete directly for customers attention. In Iraq, CYJAX found former US M16 rifles, Russian made AK variants, and Chinese Norinco rifles being offered to would-be customers. Some of these weapons were formerly distributed as military aid to Israel, which were left at war scenes and subsequently have been made for sale by smugglers. Whilst the laws in the MENA region are more favourable to gun ownership, when compared to the UK, the underground firearm scene continues to flourish. 

Within South and East Asia, Russian AKs remain popular. Stolen supplies, such as AK-47s and AR-15s, are typically smuggled on the borders between Thailand, Cambodia, and Myanmar and help fuel the growing trade in the illegal arms market within Southeast Asia.  Despite this, firearms from domestic production are also in strong demand in East Asian Telegram gun markets. China produces its own copies of the AK assault rifle known as the Type 56, similarly North Korea with its Type 58. Moreover, South Korea are self-sufficient with their own manufactured guns. The K2C1 assault rifle from S&T Motiv (formerly Daewoo Precision Industries) and Dasan Machineries is commonly found distributed within their military. 

Figure 3

Whilst vendors can be seen offering an array of firearms, from automatic full-sized AR-15 rifles to ex-service rifles such as the FN FAL, it appears that handguns are the most common firearm for sale. CYJAX’s analyst team found handguns were both the most requested and sold within the Telegram firearms communities. Demand is high for Glocks and Taurus’ in particular, as anecdotal reports of their reliability within groups further increases their popularity. Glock pistols have drawn praise amongst threat actors for their concealability and reliability, when compared to larger AR-15 rifles. The choice of smaller pistols is akin to the reason why more people use mobile phones more often than laptops. When roaming the day-to-day UK streets, the firepower of a larger rifle is unnecessary, and a Glock is sufficient due to its offensive and defensive purposes. This can be seen in the Office for National Statistics Crime and Justice annual stats which shows that handguns have been the most commonly used gun type in UK firearm offences compared to rifles since 2010/11.

Moreover, smaller pistols are cheaper to manufacture, carry less ammunition and have less firepower, thus are typically priced lower than other longer guns. We see Glocks priced at an average $500-$550, with the cheapest priced between $300-$350. Whereas for AK-15 rifles, we can see them at a baseline cost of $500-$750, moving to the $1000 range for higher quality AKs and reaching to $2000 and more for customisation. 

Figure 4

Alongside the demand for handguns, CYJAX found an emerging market for small Personal Defence Weapons (PDWs). Despite the obvious firepower disadvantage, when compared to a full-sized rifle, the controllability and concealment which comes with a PDW provides some of the benefits of a pistol, whilst increasing firepower. Demand for PDWs largely comes from mainland Europe and US, with the AAC Honey Badger, AR-5, Kel-Tec P50, SUB-2000s, and CZ Scorpion amongst the most demanded PDWs. 

Figure 5

Despite the US Second Amendment protecting “the right of the people to keep and bear Arms”, firearms are most advertised for the US market on Telegram. A reason may be due to the gun regulation laws varying from state to state, with some being more restrictive and others being more lenient on the possession and purchasing of guns. To legally purchase guns in the US, buyers must pass certain requirements and background checks which can include age, immigration status, criminal history, drug abuse history, and more. For people who are denied and prohibited based on the Gun Control Act of 1968, Telegram offers an alternative and possibly easier route to obtaining a gun; a buyer on Telegram only needs to have the financial funds. 

Figure 6

The US law enforcement uses the National Tracing Center (NTC), which is a firearms tracing facility from The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF), to find the origin of a firearm left at a crime scene. The process uses the ATF Form 4473s that are filled out when purchasing a firearm from a Federal Firearms License (FFL) holder. Dealers maintain these mandatory documents for 20 years and archive them to the ATF if the business closes. The trace provides information about the manufacturer, the wholesaler or distributer, the licensed dealer and the purchaser of the gun. This can “can help to link a suspect to a firearm in a criminal investigation and identify potential traffickers”. One of Telegram’s large appeal is its untraceable purchase nature which gives user’s complete anonymity.

CYJAX’s analyst team have observed that the threat actors running channels often claim to have an established UK/Europe market base through other illegal products or fraud services. Such examples are drugs, and clone cards. This implies that threat actors could have the capability to supply and distribute firearms to potential UK buyers. One threat actor that we have observed claimed its firearms demand comes mainly from the UK, and Central and Western Europe (and Asia/Pacific). 

Figure 7

Additionally, another threat actor had pinned a price list for Glocks advertising the currency in Euros. This suggests that customer supply and demand, as well as target audience could be expanding to Europe, with a possibility of guns being available to UK buyers.

Figure 8

The arrest and release of Telegram CEO Pavel Durov in August 2024 and the subsequent policy changes to Telegram have influenced some threat actors to migrate to other encrypted messaging platforms. Durov was arrested for being complicit and negligent of illegal activities conducted on Telegram. Policy changes include the disclosure of a user’s IP address and phone number upon legal request on the violation of Telegram rules. For threat actors and their customers, this change endangers their anonymity which is a key aspect to their criminal activities. Whilst a small migration to alternative encrypted messaging platforms in support of their criminality has been seen, threat actors continue to use Telegram to conduct their illegal activities. Telegram is still the preferred criminal cyber space because of its large existing user base and community features. 

Figure 9

The CYJAX OSINT team’s investigation into the current market and demand for firearms highlights how threat actors have taken advantage of the platform Telegram to further the illegal arms business. Telegram holds power to push the arms market to wider audiences and potentially supply the demand within the UK. 

As these risks grow, real-time intelligence becomes vital. To see how CYJAX can help your organisation stay ahead of emerging threats, book a demo with our team today.