The largest law enforcement operation in recent times has just wrapped up its first phase. This resulted in the largest hub for hackers being seized with multiple people raided and arrested. The operation was headed by the FBI, with international law enforcement cooperation. This operation comes amid major crackdowns against hacking communities. Not long ago the largest hacker forum was taken offline.
Genesis - A brief history
Genesis is a forum/market that is used by hackers to share ideas, sell and buy tools, guides hacked and stolen data, and much more. The website first appeared in 2018, starting to gain traction almost immediately. Over the years genesis amassed thousands of users, with over 80 million stolen/hacked records available for sale. The market also managed to create one of the largest bot-networks in history that users had the ability to rent. The bot-network consisted of nearly 2 million hacked computers, most of which were located in Europe and North America.
Operation Cookie Monster
The name of the operation comes from the cookie exploits available for sale on genesis. Headed by US law enforcement, the operation cookie monster consisted of over 20 law enforcement agencies. Up to 56 FBI field offices were all working on this operation at once. On April 5th the domains belonging to Genesis were seized. Soon after authorities in 17 countries started arresting members associated with the organization. The end result was 119 arrests with over 208 property searches. Authorities also reported seizing infrastructure associated with the website.
In-depth details on the operation are still not available, this includes the date it started. Despite that, court documents prove that the FBI was on genesis for at-least 2 years. The document states that authorities managed to hack genesis twice, once in late 2020, and another time in mid 2022. Both times they managed to get into the websites back end, grabbing data belonging to nearly 60,000 users.
Aftermath
Despite the clear-net addresses being seized, Genesis is still up and running. It can be accessed via its tor address like usual. It is unclear if law enforcement failed to access the servers, or if they set up a honeypot to gather information for future arrests. Based on the documents revealing law enforcement previously had accessed the server it is very likely that they are still under their control.
The arrests made included people associated with genesis operations, along with 19 users of the platform. No genesis administrators or owners were arrested in the operation. The owners of the website are believed to reside in Russia, making it impossible for western law-enforcement to take any action.
More about Genesis
Being such a large platform, genesis is involved in many bot and cyber attacks. The platform sold all sorts of malware that was used by hackers to conduct major attacks that made the news. Users could also purchase large data dumps that include different types of information on the victims. The information could then be used to hack some of their accounts, or for social engineering and extortion.
Other exploits available for sale included cookie and fingerprint data. The data was stolen from compromised devices belonging to victims across the world. That data could then be used to restore a session the user previously had access too on the compromised device, including financial websites or applications. Even source codes belonging to large corporations was available for sale on the platform. One of the most notable was the FIFA 21 source code which was up for sale on genesis.
What's next for Genesis?
Because of the fact that it's unclear if law enforcement actually compromised the genesis servers , the platforms future is unclear. Even if it turns out that the platform is untouched, users are unlikely to ever trust it again due to the risks of a honeypot. The documents revealing how the servers were previously compromised also add to that point.
Some sellers based on genesis commented on the situation. Many believe that the market will be relaunched in a group form on platforms like Telegram or Discord. It is unclear how accurate this is as this would make it easy for law enforcement to access information and shut down the groups.
0 Comments