On Thursday, an international coalition of law enforcement agencies from Australia, France, Germany, Greece, Italy, Romania, Spain and the United States took down and seized two prominent hacking forums and two other related cybercriminal services.
After the takedown operations were revealed by Europol and Germany’s Bundeskriminalamt (BKA) on Thursday, the U.S. Department of Justice published its own announcement, providing more details about the two forums, which were called Cracked and Nulled.
According to the DOJ, since 2018 Cracked had over four million users who traded in cybercriminal tools and stolen information, producing around $4 million in revenue. Prosecutors say the data on the cybercrime forums affected at least 17 million Americans.
Among those affected includes a woman in New York who was allegedly “cyberstalked,” “sextorted,” and harassed by someone who used a product offered on Cracked, which promised access to “billions of leaked websites” by letting users search for stolen login credentials, prosecutors said.
“A cybercriminal entered the victim’s username into the tool and obtained the victim’s credentials for an online account. Using the victim’s credentials, the subject then cyberstalked the victim and sent sexually demeaning and threatening messages to the victim,” according to the DOJ, which said that the seizures of the forums have the goal of disrupting “this type of cybercrime and the proliferation of these tools in the cybercrime community.”
As another example the DOJ said there was a product on Nulled that claimed to contain the names and Social Security Numbers of 500,000 U.S. citizens.
Nulled, which operated since 2016, had more than five million users and over 43 million posts advertising hacking tools and stolen data. The DOJ said Nulled had an annual revenue of around $1 million.
The DOJ press release said that Lucas Sohn, a 29-year-old Argentinian living in Spain, is accused of being an “active administrator” of Nulled, and faces criminal charges for several cybercrimes, including trafficking passwords and other data to access computers without authorization.
Sohn faces a maximum penalty of five years in prison for conspiracy to traffic in passwords, 10 years in prison for access device fraud, and 15 years in prison for identity fraud, the DOJ said.
