The malware selling and trading forum Darkode, returned two weeks after its closure by the FBI.
The English-speaking forum was founded in 2007, και από τότε είναι ένας σημαντικός παίκτης στην υπόγεια διαδικτυακή εγκληματικότητα, καθώς τα μέλη του πωλούν και αγοράζουν zero-day, malware, Trojans, and stolen credit card numbers.
The site was closed early in the month when the FBI and the European Cybercrime Center turned it off, indicating that at least 28 users and managers from 20 countries were arrested.
But today the forum seems to be online again. Indeed, the Darkode administrator, also known as Sp3cial1st, confirmed the credibility of the new site to the researcher MalwareTech.
The investigator confirmed that Sp3cial1st revealed information that only the two of them knew. "It's definitely legit," says MalwareTech.
The Darkode.cc domain has been functioning since today, and has already registered most mods and senior members. It uses the Tor routing service to provide its users with unique website addresses, as Sp3cial1st says on the new site.
"It seems that the raids focused on people who were recently added or people who have been out of the scene for many years," says Sp3cial1st.
"The forum will be on the onion, and it will be accessible only with procalls, first to members we can confirm are still active.”
"Each user will have their own onion, and ID in the forum, which will be done through the Blockchain API."
Sp3cial1st also reports that the new forum will only store a user's BTC's hash, a Wallet, and a nickname.
The administrator warns that anyone who claims to be a non-invited member is a fraudster and that all users who joined the old Darkode in the last eight months should be considered trusted aka unreliable.
Of course, we should mention that this move, two weeks after the forum was closed, is quite suspicious. After all, the FBI's technique of fabricating is well known honeypots and wait for those interested.
