Back in 2015, few would have foresaw what Raid Forums would become when it was first created by a then 14-year old Portuguese citizen. Fast forward seven years and half a billion members later, its seizure by law enforcement in February 2022 had left a sizable chunk in the cybercriminal landscape. Although there were and still are a number of viable alternatives to house Raid’s mass audience—as we discussed in a recent blog looking at forum takedowns and potential alternatives—unsurprisingly, it isn’t easy to gain the trust and loyalty of cybercriminals.…

Following a few months of the dust settling and the cybercriminal world catching its breath, Breach Forums has emerged as a strong candidate to take its place, in a carbon copied version of its predecessor. And despite marketing itself as a separate entity, the similarities between the two have been obvious from the start. So much so that it seems those who were once a part of the Raid Forums community are slowly re-appearing on Breach Forums, leading to the younger sibling making strides to take over the mantle from its older counterpart.

At the time of seizure, Raid Forums had amassed a global audience throughout a seven year period, and despite Breach forums’ own audience numbers currently sitting at just under 10% off this total, its ability to become a high-traffic global hub for selling stolen data simply cannot be ignored. A simple fact highlighted by a recent milestone the forum achieved, which is what this blog will explore.

HOW IT BEGAN WITH RAID FORUMS

Once the kingpin of the English-language cybercriminal underground, Raid Forums was a forum created in 2015 by a then 14 year old Portuguese citizen (called Diogo Santos Coelho aka “Omnipotent”). This forum would continue to grow in popularity over the next 7 years, becoming a major marketplace for criminal activity, up until its eventual seizure in late February 2022. Although few would have predicted this outcome, the forum stats proved otherwise, indicating the influence the forum had on the cybercriminal community. Most notably, the likes of ShinyHunters, GnosticPlayers, and TeamKelvinSecTeam, all became key members and consistently used the platform to share high-value databases. Following its seizure, it was not obvious where the forum’s audience would turn too in their hour of need, however, like most things, time and people eventually move on. 

Although in its infancy at the time and despite being active for a matter of weeks, Breach Forums had already put their hand up to take on the responsibility. Despite the wider community remaining skeptical at the time—owing to similar claims by others over the years following countless marketplace and forum seizures—as the months have ticked by, the creator of the forum is already making good on their claims by surpassing data trafficking stats in mere months which took Raid Forums years to accumulate.

BREACH FORUMS STEPPING UP TO THE HELM

Breach Forums came to fruition back in March 2022. Its creator and administrator “pompompurin”—who interestingly was a big-player on Raid Forums back in the day—has quickly elevated this platform into the one of the next go-to hotspots on the English-language cybercriminal scene. Following the takedown of its older sibling, the forum has grown increasingly in popularity owing to its member base (41.5K members – an almost 35,000 rise since April 2022) and their selling of media-attention seeking datasets, such as the July 2022 Shanghai National Police database (a database containing the details of over 1 billion Chinese citizens being advertised for sale for 10 bitcoins). However, what is more of a concern is a forum thread created by pompompurin themselves in late June 2022. This Indicated the forum had successfully accumulated data records totalling approximately 10.9 billion spread across “533 Datasets”, which surpasses the previous records held by Raid Forums— which at the time was 10.8 billion. This is a staggering number considering the forum’s four month lifespan, and even more so when you realize Raid Forums was operational for 7 years!

To highlight this achievement, pompompurin created a dedicated thread to outline the direct comparison between Breach Forums and Raid Forums number count. This feat was quickly praised by the forum’s community,—and continues to be— to demonstrate how the forum has taken on the mantle left by Raid Forums. Even though such data is much easier to collate due to a plethora of both public and private data breaches, the ability to accrue these types of numbers shows that Breach Forums is likely here to stay. 

And you might be saying to yourself right now that we have heard this all before, credentials and data are available to the highest bidder blah blah! Well let me tell you that although that is still the case, in this instance, the data is available to the Breach Forums community free of charge….. And that’s not a nice thought.

WHAT CAN WE EXPECT NEXT

Well with no signs of slowing, the threat to personal and business data from the likes of Breach Forums and co is only going to continue to grow. The speed and ease of data being shared between threat actors and platforms is only escalating and data and credentials will continue to be a valuable commodity across the cybercriminal underground. And as long as platforms such as Breach Forums continue to operate at the rate they do, with the value of customer data only rising, we encourage all organizations and individuals to take extreme caution with their data, ensuring they operate with the best practices in mind.

Here at Digital Shadows (now ReliaQuest) (now a ReliaQuest company), we think it’s important to monitor the latest developments in the cybercriminal landscape to keep abreast of the threats to our customers emanating globally. To ensure we’re providing the best possible intelligence for our customers, we need to keep our finger on the pulse of developments, and if we can predict new forum movers and shakers, all the better. We feed these observations into Digital Shadows (now ReliaQuest)’ SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) service (now ReliaQuest GreyMatter Digital Risk Protection), which features a constantly-updated threat intelligence library providing insight on this and other cybercriminal-related trends that might impact your organization and allow security teams to stay ahead of the game. If you’d like to access the library for yourself, you can sign up for a demo of  SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) (GreyMatter Digital Risk Protection) .