Over the past week, Sage Infrastructure Solutions Group has observed an 80–90% decline in infostealer logs being advertised across Russian-language Telegram marketplaces — a direct result of the Russian government’s decision to block Telegram and WhatsApp nationwide. As Russia is the origin point for many of the most prolific infostealer malware families in circulation, this represents a significant, though likely temporary, disruption to the stolen credential economy. Our team expects threat actors to eventually circumvent these restrictions, and in the meantime, we are actively expanding our collection sources to ensure our DarkWeb Leak Monitoring service continues to provide comprehensive coverage for our customers.