  The thriving mobile app ecosystem encompasses a wide range of
functionalities. However, within this ecosystem, a subset of apps provides
illicit services such as gambling and pornography to pursue economic gains,
collectively referred to as "underground economy apps". While previous studies
have examined these apps' characteristics and identification methods,
investigations into their distribution via platforms beyond app markets (like
Telegram) remain scarce, which has emerged as a crucial channel for underground
activities and cybercrime due to the robust encryption and user anonymity.
  This study provides the first comprehensive exploration of the underground
mobile app ecosystem on Telegram. Overcoming the complexities of the Telegram
environment, we build a novel dataset and analyze the prevalence, promotional
strategies, and characteristics of these apps. Our findings reveal that these
apps reach approximately 1% of Telegram's user base, primarily catering to
gambling and pornography services. We uncover sophisticated promotional
strategies involving complex networks of apps, websites, users, and channels,
and identify significant gaps in Telegram's content moderation capabilities.
Our analysis also exposes the misuse of iOS features for app distribution and
the prevalence of malicious behaviors in these apps. This research not only
enhances our understanding of the underground app ecosystem but also provides
valuable insights for developing effective regulatory measures and protecting
users from potential risks associated with these covert operations. Our
findings provide implications for platform regulators, app market operators,
law enforcement agencies, and cybersecurity professionals in combating the
proliferation of underground apps on encrypted messaging platforms.
