RaidForums – a data breach marketplace where threat actors sell or leak data dumps

guest · Sep 22, 2021

RaidForums data marketplace accidentally exposes private staff page
September 22, 2021
https://www.bleepingcomputer.com/ne...lace-accidentally-exposes-private-staff-page/

Underground marketplace and hacker forum, RaidForums, recently exposed internal pages from its website, meant for staff members only.

RaidForums is a data breach marketplace where threat actors often sell or leak illicitly obtained data dumps.
Click to expand...

Oops! RaidForums makes its staff area public
RaidForums is an underground place where private databases obtained from data breaches, vulnerability exploits, and credit card information sets are illegally traded by threat actors, or sometimes leaked for free.

On RaidForums, the "Staff General" section is typically restricted to internal staff members only, but in an ironic twist of fate, this private section was accidentally left open for viewing by anyone.
Other topics seen in the private area have included discussions on bans, the preferred place for hosting staff chat, and miscellaneous requests.
Click to expand...

At the time of our tests today, though, the "Staff General" section is now, once again, restricted to authorized personnel.
Click to expand...

guest · Oct 4, 2021

RaidForums forced to use mirror after Brazilian govt contacts registrar
October 4, 2021
https://www.bleepingcomputer.com/ne...rror-after-brazilian-govt-contacts-registrar/

The RaidForums hacking forum has gone through a turbulent week, with its website now forced through a mirror domain after a government filed a legal request with their registrar.

Last week, the popular hacking forum suddenly stopped working, leading people to wonder if law enforcement seized the site.
However, it was soon back up on a mirror domain with an announcement from the site's owner that explained the outages were caused by a reluctance of their new registrar, NameSilo, to ignore the large number of government reports that regularly target the platform.
Click to expand...

Raidforums is a clearnet site that lets users share, sell, and buy almost any data they want, including stolen data.

This clearly doesn't resonate well with entities that suffer large-scale exposures or copyright infringement damages from what users post on the forum, so a deluge of takedown requests is common for the hacking forum.
Data breach expert "Dissent Doe" was told by the site owner that the report which resulted in their account entering a "client hold" status came from the Brazilian government.
Click to expand...

The RaidForums owner claimed they moved from CloudFlare to NameSilo to strengthen its OpSec, and this was supposed to be a temporary, transitional step. However, because domains can only be transferred once every 60 days, waiting until October 30th, 2021, is now mandatory.
Click to expand...

guest · Oct 28, 2021

The Desorden Group appears to be a new entrant in the hacking space. It joined RaidForums on Sept. 26
Hackers Claim 400GB of Data Stolen From Thai Hotel Chain
Desorden Group Attacks Thailand's Central Group of Companies
October 28, 2021
https://www.databreachtoday.com/hackers-claim-400gb-data-stolen-from-thai-hotel-chain-a-17814

The Desorden hacker group claims to have hacked and stolen data belonging to Thai luxury hotel chain Centara Hotels & Resorts, according to a post on RaidForums, an underground database sharing and marketplace forum.

The group says it has access to 400GB of files and databases from five servers in the company's network that contain millions of pieces of hotel guest information, financial data and corporate information, according to the post.
Click to expand...

The hacker group shared a sample of the stolen database on RaidForums in the form of CSV files. On cross-checking the leaked contact numbers on caller identification platform Truecaller, Information Security Media Group found them to be legitimate.

Centara Hotels was informed of the breach on Oct. 14. In a public statement issued on Oct. 27, the company said it had appointed a digital forensic consultant to investigate and validate the compromised data,
The compromised data, according to the hotel chain's statement, includes general personal data, booking information, email IDs and telephone numbers.
Click to expand...

More Attacks
Prior to announcing the Centara Hotels exploit, the Desorden Group said on Oct. 26 that it had hacked and breached Thailand's Central Restaurants Group - part of The Central Group of Companies, a family-owned conglomerate involved in real estate, retail, hospitality and the restaurant businesses.
Since the fallout, the hacker group says it has been attacking and breaching many businesses in The Central Group of Companies.
Click to expand...

On Oct. 14, the Desorden Group posted a note claiming it had exfiltrated 60GB of files and databases from Acer's India-based servers. The files included customer, corporate, account and financial data. The group had also successfully attacked Acer in Taiwan.

On Oct. 21, Singapore-based newspaper The Straits Times reported that Protemps Employment Services, a Singapore employment agency, had been hacked on Oct. 4, and the personal details and salary details of 40,000 job seekers had been compromised.
Click to expand...

FanJ · Apr 12, 2022

One of the world’s biggest hacker forums taken down - Europol - 12 April 2022
https://www.europol.europa.eu/media...e-of-world’s-biggest-hacker-forums-taken-down

The illegal marketplace ‘RaidForums’ has been shut down and its infrastructure seized as a result of Operation TOURNIQUET, a complex law enforcement effort coordinated by Europol to support independent investigations of the United States, United Kingdom, Sweden, Portugal, and Romania. The forum’s administrator and two of his accomplices have also been arrested.
Click to expand...

Launched in 2015, RaidForums was considered one of the world’s biggest hacking forums with a community of over half a million users. This marketplace had made a name for itself by selling access to high-profile database leaks belonging to a number of US corporations across different industries. These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts.
Click to expand...

Log in or Sign up

RaidForums – a data breach marketplace where threat actors sell or leak data dumps

guest Guest

guest Guest

guest Guest

FanJ Updates Team

Log in or Sign up

RaidForums – a data breach marketplace where threat actors sell or leak data dumps

guest Guest

guest Guest

guest Guest

FanJ Updates Team

Useful Searches