The US Federal Bureau of Investigations (FBI) has taken down its second cybercriminal forum of the year. Known and used by hackers around the world – the notorious Genesis Market has met its end.
Now, where the Genesis Market domain once lived, the FBI put up its calling card instead.
The FBI is calling the global sting Operation Cookie Monster.
“Genesis market’s domains have been seized by the FBI pursuant to a seizure warrant issued by the United States District Court for the Eastern District of Wisconsin,” the FBI replacement webpage states.
Genesis Market is known in the hacker community as an invitation-only, dark web forum, and has been in existence since March 2018, with users all over the world.
The market is estimated to have offered up over 1.5 million computers compromised around the world containing over 80 million account access credentials, the US Department of Justice (DOJ) said.
Operation Cookie documents released Thursday by the DOJ show that the FBI had been working the case dating back to December 2020.
The Takedown
The FBI’s Milwaukee Field Office led the complex international investigation, which involved 44 other FBI field offices, law enforcement organizations worldwide, including Europol, and private sector coordination.
The documents also show the FBI’s break in the ase was obtaining an forensic image of the server hosting the Genesis’ Backend #1 IP address.
That server contained “voluminous records” associated with the market’s operations, including its “customers” usernames, passwords, email accounts, Jabber accounts, search histories, purchase history, and even BTC addresses, according to the FBI documents.
Today’s takedown of Genesis Market is a demonstration of the FBI’s commitment to disrupting and dismantling key services used by criminals to facilitate cybercrime,” said FBI Director Christopher Wray.
Besides the Genesis Market online site, the sting resulted in the seizure of 11 other domain names used to support the market’s infrastructure.
“The takedown is a warning shot over the bow of digital identity stealers," said Matthew Gracey-McMinn, Head of Threat Research at Netacea, a UK-based bot software management firm.
“The Genesis Market was a large, well-known marketplace, and takedowns such as this may scare others operating in this space, encouraging them to slow down or cease their operations, especially if arrests are made," Gracey-McMinn said.
Although the DOJ gave little detail about other arrests, British authorities said there were roughly 120 arrests, more than 200 searches conducted, and almost 100 pieces of "preventative activity."
“This case is a great example of the FBI’s ability to leverage our technical capabilities and work shoulder-to-shoulder with our international partners to take away the tools cybercriminals rely on to victimize people all across the world,” FBI Chief Wray said.
Who is Genesis Market?
Besides credentials such as usernames and passwords for email, bank accounts, and social media, the site sold digital fingerprints, stealer malware, and web vulnerability kits – and as Initial access brokers (IABs), selling illegitimate access to corporate networks.
Digital fingerprints are “unique combinations of device identifiers and browser cookies that circumvent anti-fraud detection systems used by many websites,” allowing the purchaser to assume the full identity of a victim, the FBI explained.
The market was found selling the digital fingerprints of more than 2 million people, said UK officials.
Many of the IABs sold were proven to have been used in many global ransomware attacks, including those connected to the financial sector, critical infrastructure, and federal, state, and local government agencies, the DOJ said.
0 Comments