Operation Cookie Monster: Feds seize “notorious hacker marketplace”

A global regulation enforcement operation shut down a “infamous hacker market” that bought entry to contaminated units and stolen account credentials, the US Division of Justice and Europol introduced right now. The operation concentrating on Genesis Market concerned 17 nations, seized the platform’s infrastructure, and resulted in “119 arrests, 208 property searches, and 97 knock-and-talk measures,” Europol said.

The now-shuttered Genesis Market “marketed and bought packages of account entry credentials—akin to usernames and passwords for e mail, financial institution accounts, and social media—that had been stolen from malware-infected computer systems world wide,” the Justice Department said. The so-called “Operation Cookie Monster” seized 11 domains pursuant to a warrant licensed by the US District Courtroom for the Japanese District of Wisconsin.

Whereas Genesis Market’s public website was taken down, its .onion area was nonetheless accessible on the darkish internet utilizing Tor right now. Regulation enforcement is seemingly nonetheless searching for no less than a few of the folks behind the platform, because the area seizure message seeks ideas from anybody who’s been in touch with Genesis Market directors. The US Treasury Division said Genesis Market “is believed to be situated in Russia.”

Europol mentioned that “in contrast to different felony marketplaces, Genesis Market was accessible on the open internet, though obscured from regulation enforcement behind an invitation-only veil. Its accessibility and low cost costs drastically lowered the barrier of entry for patrons, making it a preferred useful resource amongst hackers.”

Genesis Market reportedly had about 59,000 registered customers. Based on Europol, the market’s “primary felony commodity was digital identities” or “what the market house owners known as ‘bots’ that had contaminated victims’ units by way of malware or account takeovers.”

Operation Cookie Monster was led by the FBI and Dutch Nationwide Police, with coordination by Europol.

“Customized browser” mimicked victims’ units

Genesis Market emerged in March 2018 and since then “has supplied entry to information stolen from over 1.5 million compromised computer systems world wide containing over 80 million account entry credentials,” the Justice Division mentioned.

Upon buying a bot from Genesis Market, “criminals would get entry to all the information harvested by it akin to fingerprints, cookies, saved logins and autofill type information,” Europol mentioned. The most affordable bots bought for lower than a greenback every however others fetched tons of of {dollars} and offered entry to on-line banking accounts.

Europol mentioned that Genesis Market buyers have been “supplied with a customized browser which might mimic the considered one of their sufferer,” letting them entry victims’ accounts “with out triggering any of the safety measures from the platform the account was on. These safety measures embrace recognizing a special log-in location, a special browser fingerprint or a special working system.”

A Brian Krebs report described the Genesis providing as “a customized Internet browser plugin which might load a Genesis bot profile in order that the browser mimics just about each vital facet of the sufferer’s machine, from display screen measurement and refresh fee to the distinctive person agent string tied to the sufferer’s internet browser.”

The DOJ mentioned it accessed Genesis Market’s person database. “The database contained the acquisition and exercise historical past on all customers, which the feds say helped them uncover the true identities of many customers,” Krebs wrote.

Three massive takedowns prior to now yr

The Genesis Market takedown follows related actions in opposition to Hydra Market in April 2022 and BreachForums in March 2023. The DOJ claims it has “dismantled the darknet’s largest marketplaces” attributable to these three operations during the last yr.

The Justice Division mentioned sufferer credentials obtained throughout Operation Cookie Monster have been offered to HaveIBeenPwned.com, which helps you verify whether or not you have been concerned in an information breach.

The Treasury Workplace of International Belongings Management (OFAC) mentioned it designated Genesis Market, that means that “all property and pursuits in property of the entity which are in the US or within the possession or management of US individuals have to be blocked and reported to OFAC.” Moreover, anybody who “interact[s] in sure transactions with the entity designated right now could themselves be uncovered to sanctions.”