This week, the U.S. Department of Justice confirmed the seizure of 11 domains used by Genesis Market, an underground marketplace for cybercriminal trade activities. The FBI took action after a Wisconsin Court issued a warrant against the dark web platform dealing in compromised credentials, among other stuff.
Dubbed Operation Cookie Monster in reference to one of Genesis Market’s major illicit trades of online fingerprints, known as cookies, the action involved collaborating with law enforcement agencies from the U.K., Italy, Denmark, Australia, Canada, Romania, France, Spain, Germany, Sweden, Poland, Netherlands, Finland, Switzerland, Estonia, Iceland, New Zealand, and Europol.
“The Genesis marketplace was one of the most established Identity Access Brokers, so this is a big win for the FBI,†Julia O’Toole, CEO of MyCena Security Solutions, told Spiceworks.
“The operators of the site would collect data on internet users, including their login credentials, auto-filled passwords, and browser cookies in a bid to bypass MFA and access their online accounts. When they gained access to these, there would be no alerts that the account was compromised as attackers simply logged in, so it was only after fraudulent activity occurred that the victim was made aware.â€
Mark Lamb, CEO at HighGround.io, explained how Genesis Market would function to Spiceworks. “The operators offered customers a pre-made package on victims, enabling them to access accounts and execute attacks quickly, with all the information they needed to commit fraud. Unfortunately, very few victims were aware they had been compromised until the money was stolen or goods were purchased, as there was nothing malicious for threat detection tools to alert on,†Lamb said.
As part of Operation Cookie Monster, law enforcement conducted 200 searches globally and made 120 arrests. The FBI also identified 59,000 users of the illicit information access broker.
Genesis Market Seize Notice
It should be noted that only the open web domains of Genesis Market, which initially started in 2017, were taken down and that the dark web ones are still active. The dark web Genesis site “remains accessible, stable, and functional via the TOR address,†according to researchers at ZeroFoxOpens a new window .
See More: Lessons from Netflix’s Password-Sharing CrackdownÂ
On April 5, 2023, at 5:00 AM (DST), Genesis Market admins posted, “Web domains have been blocked; we are working at the old address in TOR: [address]. We are working on launching the plugin via TOR. Now there will be a lot of fake shop domains, do not enter your username and password into unknown URLs. New web domains will be announced soon.â€
Meaning some admins are still at large.
Genesis Market has more than 80 million account access credentials taken from 1.5 million compromised computers globally, according to the DoJ. Notably, the site operated as an “invite-only cybercrime institution that held data on account holders from almost all major websites,†according to Lamb.
Moreover, Genesis Market didn’t just offer a one-time purchase of stolen information. Sophos foundOpens a new window that it could consistently offer its customers, primarily hackers, access to updated credentials (i.e., even if the victim user changed it) as long as it has access to a compromised system. The admins made this possible using persistent, credential-harvesting, home-phoning automated malware spread on bots (individual compromised systems).
“This is another coup for the FBI that follows a long string of recent takedowns. It will be interesting to see if the operators of Genesis are caught because, given the scale of the operation they were running, the FBI will not let them off lightly.â€
Sophos described Genesis Market as robust and compared it to mainstream data-aggregation services, complete with a wiki, a FAQ page, multilingual tech support, well-written text, and presentation.
O’Toole added, “Marketplaces like Genesis highlight the dangerous consequences when employees save their passwords in browsers. Yes, it may be more convenient, but when their device or internet search account falls into the wrong hands, a criminal is suddenly awarded access to everything. It is akin to putting all your eggs in one basket, something we are always told to avoid.â€
“To counter breaches that use credential theft or stolen identities, organizations must move away from employee-made passwords, biometric passwordless identification, and single sign-on solutions. Instead, they can rely on technology that generates and encrypts strong independent passwords for their employees. This removes the threat of password phishing and Identity Access Brokers selling their credentials, which effectively puts an end to sites like Genesis.â€
Let us know if you enjoyed reading this news on LinkedInOpens a new window , TwitterOpens a new window , or FacebookOpens a new window . We would love to hear from you!
Image source: Shutterstock
MORE ON DATA SECURITY
- Twitter Asks Court to Subpoena GitHub Over Source Code Leak
- Losses to Cybercrime Surge to $10.2 Billion Riding on Investment Fraud
- WT1STOP Marketplace Seized For Trading Stolen Credentials, Operator Faces Charges
- Darknet Megamarket Hydra Gets Dismantled, but Russian-speaking Admins Still at LargeOpens a new window
- U.S. House Health Insurer Suffers Data Breach: Members and Staff Affected