International law enforcement agencies have seized a sprawling dark Web marketplace popular with cybercriminals, Britain’s National Crime Agency (NCA) said on Wednesday, in a multinational crackdown dubbed “Operation Cookie Monster”.

A banner plastered across Genesis Market’s site late on Tuesday said domains belonging to the organisation had been seized by the FBI. Logos of other European, Canadian and Australian police organisations were also emblazoned across the site, along with that of cybersecurity firm Qintel.

“We assess that the Genesis is one of the most significant access marketplaces anywhere in the world,” said Rob Jones, the NCA’s director-general of threat leadership.

The NCA estimated that the service hosted about 80 million credentials and digital fingerprints stolen from more than two million people.

US justice department deputy attorney-general Lisa Monaco said in a statement that many of the forum’s users were arrested on Tuesday. The investigation into Genesis is still ongoing.

The US treasury department in a statement announcing sanctions against the market called it “one of the most prominent brokers of stolen credentials and other sensitive information”.

British authorities said 17 countries were involved in the operation, which was led by the FBI and Dutch national police and resulted in about 120 arrests, more than 200 searches and almost 100 pieces of “preventative activity”.

Qintel did not immediately return messages seeking comment and contact details for Genesis Market’s administrators, which the US treasury said were believed to operate from Russia, could not be obtained.

Harvested

Genesis specialised in the sale of digital products, especially “browser fingerprints” harvested from computers infected with malicious software, said Louise Ferrett, an analyst at British cybersecurity firm Searchlight Cyber.

Because those fingerprints often include credentials, cookies, IP addresses and other browser or operating system details, they can be used by criminals to bypass anti-fraud solutions such as multi-factor authentication or device fingerprinting, she said.

The site had been active since 2018.

The NCA said Genesis had operated by selling credentials from as little as US$0.70 to hundreds of dollars depending on the stolen data available.

Read: US plan would hold software makers responsible in hacks

“To get up and running on this you just have to know of the site, potentially be able to get yourself an invite which given the volume of users probably wouldn’t be particularly difficult,” said Will Lyne, NCA head of cyber intelligence. “Once you become a user, it’s really easy to then … perpetrate criminal activity.”

The NCA said countries involved in the investigation included Australia, Canada, Denmark, Estonia, Finland, France, the US, the UK, Germany, Iceland, Italy, New Zealand, Poland, Romania, Spain, Sweden and Switzerland. — Michael Holden, James Pearson and Christopher Bing, (c) 2023 Reuters