Two of the world’s largest cyber crime forums have been taken down following an international law enforcement sting.
Cracked and Nulled boasted more than 10 million users between them, hosting discussions on cyber crime as well as operating as marketplaces for illegal goods and cyber crime as a service offers, such as stolen data, malware, or hacking tools.
"Cybercrime-as-a-service is a growing trend on platforms like Cracked.io and Nulled.to. Cyber criminals offer tools and infrastructure as a service, enabling even less technically-skilled individuals to carry out attacks," said Europol.
"These two forums also offered AI-based tools and scripts to automatically scan for security vulnerabilities and optimize attacks. Advanced phishing techniques are frequently developed and shared on these platforms, sometimes employing AI to create more personalized and convincing messages."
Authorities believe that the organizers earned €1 million in criminal profits
At the end of January, two suspects were arrested and seven properties searched, with 17 servers and more than 50 electronic devices seized, along with around €300,000 of cash and cryptocurrencies.
Meanwhile, 12 domains within the two platforms were seized along with other associated services. This included a financial processor named Sellix which was used by Cracked, and a hosting service called StarkRDP which was promoted on both of the platforms and run by the same suspects.
The Cracked marketplace had been selling stolen login credentials, hacking tools, and servers for hosting malware and stolen data, as well as other tools for carrying out cyber crime and fraud, since March 2018.
It had over four million users, listed around 28 million posts advertising cyber crime tools and stolen information, generated approximately $4 million in revenue, and impacted at least 17 million victims from the United States, according to the US Justice Department.
One product advertised on Cracked, which offered access to 'billions of leaked websites', was recently allegedly used to sextort and harass a woman in New York.
Meanwhile, along with seizing the Nulled website domain, charges have been filed against one of its administrators, Lucas Sohn, 29, an Argentinian national living in Spain.
If convicted, Sohn faces a maximum penalty of five years in prison for conspiracy to traffic in passwords, 10 years in prison for access device fraud, and 15 years for identity fraud.
The Nulled marketplace, meanwhile, had been selling stolen login credentials, stolen identification documents, hacking tools, as well as other tools for carrying out cyber crime and fraud, since 2016.
It had more than five million users, listed over 43 million posts advertising cybercrime tools and stolen information, and generated around $1 million in revenue every year.
"One product advertised on Nulled purported to contain the names and social security numbers of 500,000 American citizens," said the Justice Department.
The cases are now under investigation, with anyone visiting either of the domains now seeing a banner notifying them that they have been seized by law enforcement authorities.
