A Europol-supported operation, led by German authorities and involving law enforcement from eight countries, has led to the takedown of the two largest cybercrime forums in the world.

The two platforms, Cracked and Nulled, had more than 10 million users in total. Both of these underground economy forums offered a quick entry point into the cybercrime scene. These sites worked as one-stop shops and were used not only for discussions on cybercrime but also as marketplaces for illegal goods and cybercrime-as-a-service, such as stolen data, malware or hacking tools. Investigators estimate that suspects earned EUR 1 million in criminal profits.

The operation took place from 28 to 30 January and led to:

• 2 suspects arrested
• 7 properties searched
• 17 servers and over 50 electronic devices seized
• Around EUR 300 000 of cash and cryptocurrencies seized

Throughout the course of the action day, 12 domains within the platforms Cracked and Nulled were seized. Other associated services were also taken down; including a financial processor named Sellix which was used by Cracked, and a hosting service called StarkRDP, which was promoted on both of the platforms and run by the same suspects.

Europol’s expertise provided on the ground

Throughout the investigation, Europol provided operational, analytic and forensic support to authorities involved in the case. On the action day, a specialist and an analyst were deployed on the spot to work hand-in-hand with German investigators. 

Europol’s experts from the European Cybercrime Centre (EC3) facilitated the exchange of information in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at the Europol headquarters in The Hague, the Netherlands. One of Europol’s priorities is to act as the broker of law enforcement knowledge, providing a hub through which Member States can connect and benefit from one another’s and Europol’s expertise.

Fighting cybercrime-as-a-service

Cybercrime-as-a-service is a growing trend on platforms like Cracked.io and Nulled.to. Cybercriminals offer tools and infrastructure as a service, enabling even less technically-skilled individuals to carry out attacks. This trend makes cybercrime increasingly accessible to a wider group of people, as these platforms often share security vulnerabilities and even provide tutorials on creating malware and engaging in other criminal activities. 

These two forums also offered AI-based tools and scripts to automatically scan for security vulnerabilities and optimise attacks. Advanced phishing techniques are frequently developed and shared on these platforms, sometimes employing AI to create more personalised and convincing messages. As cybercrime becomes more aggressive and confrontational, Europol aims to strengthen the fight against this sort of crime by bringing relevant partners together for cross-border cooperation and joint action.

Participating countries:

• Australia: Australian Federal Police
• France: Anti-Cybercrime Office (Office Anti-cybercriminalité)
• Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)
• Greece: Hellenic Police (???????? ?????????)
• Italy: State Police (Polizia di Stato)
• Romania: General Inspectorate of Romanian Police (Inspectoratul General al Poli?iei Romane)
• Spain: Guardia Civil; Spanish National Police (Policía Nacional)
• United States of America: Department of Justice, Federal Bureau of InvestigatioOpen in modal