BreachForums Shutdown: English-Speaking Cybercriminal Community in Flux
Executive Summary
- BreachForums, also known as Breached, one of the largest and most popular English-speaking cybercriminal underground communities, was shut down after the FBI arrested its owner Conor Brian Fitzpatrick on March 17th, 2023.1
- Breached was the successor of RaidForums, a notorious English-speaking forum. Breached, as well as its predecessor, was dedicated to hacking, sharing valuable data leaks, and other illicit activities.
- Following Breached’s shutdown, its members began exploring alternative communities, including the more sophisticated Russian-speaking cybercrime forums.
- Due to the established reputation of the Russian-speaking underground forums, we expect to see a significant number of members migrating there as they search for alternative platforms to trade data and knowledge.
- Additionally, we will most likely see cybercriminals migrating to other English-speaking communities as well. For example, we already witnessed some ex-members of Breached active on other English-language communities such as Cracked2 and Telegram.
- The shutdown of Breached forum raises important questions about the future of the English-speaking cybercriminal underground ecosystem:
- Will there be a Breached forum substitute?
- Will English-speaking cybercriminals manage to successfully integrate into Russian-speaking underground communities?
- Will we see increased levels of cooperation between Russian and English-speaking cybercriminals against Western targets.3?
Background
BreachForums, also known as Breached, was the successor of the notorious RaidForums – one of the most popular underground forums for hacking, sharing valuable data leaks, tools, and other illicit activities, which was seized in April 2022 by the FBI. Just prior to the seizure in March 2022, “pompompurin”, a member of RaidForums, created Breached as an alternative following rumors about unusual activity in RaidForums’ infrastructure, suggesting a possible breach.
One year later, on March 17th, 2023, the FBI arrested Conor Brian Fitzpatrick, who was the real-life person behind “pompompurin”. On March 21st, “Baphomet”, one of the Breached’s admins, confirmed the shutdown on the official Breached Telegram channel.
A Community in Flux
Following Breached’s shutdown, its members started to appear on alternate underground communities. Based on new user posts in prominent English and Russian-language underground forums (e.g., Exploit4, Cracked, etc.), it seems that many Breached members are migrating to these communities. This is not entirely a new phenomenon as many members of both RaidForums and Breached (including pompompurin himself) were members of other underground communities before the respective takedowns of RaidForums and Breached. We expect to see a higher number of individuals looking for new communities to join as there is not yet a successor to Breached. The primary reason to migrate to other English-language forums is the ease of communication, integration and interaction. Moreover, many cybercriminals are already active across several English-language forums because it allows them to develop reputation and build credibility. In addition, such English-language forums often focus on similar interests and services. In fact, some English-language threat actors encourage their peers not to move to Russian forums as they expect to encounter mutual trust issues, making it very hard to operate and profit financially. Instead, they suggest joining English-language forums.
Nevertheless, due to the popularity of Russian-language forums, we expect a portion of members will join these forums given the mature state of their cybercriminal ecosystems. The Russian-speaking cybercriminal community has always been suspicious towards those who are not Russian speakers. For example, on the Russian-language forum Exploit, a new forum member posted a welcome message and received mixed greetings – some welcomed him, while others dismissed him and his colleagues as “skids” (script kiddies) and asked the forum’s admins to raise the registration fee in order to stop the influx of similar English-speaking individuals.
A similar discussion ensued on XSS forum, another leading Russian-language forum. Some forum members asked the admin to open the registration for new members6 while others opposed the idea, questioning whether the technical abilities of most of Breached’s members are on par with XSS forum’s technical level. The admin of XSS sided with the opposition in the following post:
Absolutely not. First of all, in such situation – it will be marauding from our side, we do not do this. Second of all, we have our own forum, our own community. In priority – it is Russian-speaking. We don’t plan to open English-speaking sections and attract English-speaking users. Despite the fact it is an international language, the mentality of people very different anyways. English-speaking guys who joined us, they adapt to our rules. It would be nice if it will continue like this. Thirdly, yes, a holy place is never empty. In a few days we are waiting for a new English-speaking forum to replace Breached =)
What’s next?
As in the past, when RaidForums was replaced by Breached, there is a common belief on the underground that it’s just a matter of time until a new English-speaking forum will emerge. For example, PwnedForum, as described by its owner, is planning to take the lead in the English-speaking underground world by replacing Breached. That said, although the forum indeed looks promising, it is too early to determine which forum will succeed Breached. In conclusion, the shutdown of Breached caused quite a shakeup, raising important questions about the future of the English-speaking cybercriminal underground ecosystem:
- Will there be a Breached forum substitute?
- Will English-speaking cybercriminals manage to successfully integrate into Russian-speaking underground communities?
- If so, will we see increased levels of cooperation between Russian and English-speaking cybercriminals against Western targets?
* Disclaimer: This document is provided ‘as is’ for informational purposes only, without any warranties of any kind regarding any information contained within.
2 Cracked[.]io – Leading English-speaking underground forum.
3 Targeting CIS based institutions is unlikely as the unwritten Russian underground rule prohibits targeting them.
4 Exploit[.]in – Sophisticated Russian-speaking hacking forum.
5 Xss[.]is – Leading Russian-speaking underground forum.
6 The registration to XSS forum for new members is usually closed.
7 Pwnedforum[.]com – New English-speaking underground forum.