Dark web Genesis Market Shutdown, 119 Arrested, Stops Illegal Sale of 80 Million Logins

One of the world’s most dangerous marketplaces where hackers can purchase stolen account credentials, Genesis Market, was taken down on Tuesday by international law enforcement agencies.
The takedown entailed an unprecedented operation by the Federal Bureau of Investigation (FBI) in conjunction with several police organizations and even a private cybersecurity firm, Qintel.

What is Genesis Market and How Does It Operate?

Genesis Market was a dark web marketplace where stolen digital identities were sold through ‘bots’ that had been used to install malware or compromise accounts by damaging victims’ devices. By buying a bot, criminals could obtain different kinds of digital data, including fingerprints, cookies, saved login info, and autofill form details.

Depending on the volume and type of the stolen data, the price of a bot could be as low as $0.70 or as high as several hundred dollars with the most expensive one providing financial data. This would give the hacker access to a victim’s online banking accounts.

Furthermore, the data was gathered in real time and any changes made to the passcode or credentials were communicated to the criminal holding the bot. The hacker was not only provided with the bot but also the means to use it.

To avoid setting off any protection features such as the ones that identify a change in the operating system, browser fingerprint, or log-in location, buyers also received a customized browser that looked like the victim’s. This gave the criminals access to their victim’s accounts without raising suspicion.

The site was popular among hackers due to its affordability as well as accessibility since unlike other sites, Genesis Market was accessible through the open web. However, to protect it from law enforcement, the site was hidden behind an invitation-only wall.

According to the Department of Justice, since the website’s launch in 2018, it has provided access to information taken from more than 1.5 million compromised devices, totaling more than 80 million credentials that could be used to access accounts illegally.

The Takedown Operation

The global takedown operation was coordinated from a command post at Europol’s headquarters in The Hague, the Netherlands. Prior to the operation, an investigation led by the Joint Cybercrime Action Taskforce (J-CAT) with support from Europol’s European Cybercrime Center (EC3), had been ongoing since 2019.

On April 4th, parallel operations led by the FBI took place in 17 countries, including France, the UK, Australia, and Canada, resulting in a total of 119 arrests, 208 property searches, and 97 knock-and-talk procedures. The FBI then seized Genesis Market’s domains and left a banner on the site titled “Operation Cookie Monster” informing users of the shutdown.

Additionally, the U.S. Treasury Department also placed sanctions on the marketplace, which is believed to be based in Russia.

Edvardas Ileris, the director of Europol’s European Cybercrime Centre, made remarks on the operation saying,” Through the combined efforts of all the law enforcement authorities involved, we have severely disrupted the criminal cyber ecosystem by removing one of its key enablers. With victims located across the globe, the strong relationships with our international partners were critical in the success of this case.

The banner of the site also includes a link to a portal developed by the Dutch Police to enable the public to confirm whether their credentials have been compromised.

Users who receive confirmation from the portal that their identities have been stolen are advised to run their antivirus to get rid of the malware before changing their passwords. In the case of financial credentials, the victim should contact their bank or insurance company to handle the situation.

Related Articles:

• Mountain Bike Inventor Gary Fisher Has a New e-Bike Project Using Cutting-Edge Battery Tech
• Microsoft Copilot is Now Available on its Note-Taking App OneNote
• ChatGPT Has a Problem – It Wrongly Identified a Professor as a Sexual Harasser, Citing Fake Article