Â鶹´«Ã½

Skip to main content

'Operation Cookie Monster': International police action seizes dark web market

A person is seen typing. (Pressmaster/shutterstock.com) A person is seen typing. (Pressmaster/shutterstock.com)
Share
WASHINGTON/LONDON -

International law enforcement agencies have seized a sprawling dark web marketplace popular with cybercriminals, Britain's National Crime Agency (NCA) said on Wednesday, in a multinational crackdown dubbed "Operation Cookie Monster."

A banner plastered across Genesis Market's site late on Tuesday said domains belonging to the organization had been seized by the FBI. Logos of other European, Canadian and Australian police organizations were also emblazoned across the site, along with that of cybersecurity firm Qintel.

"We assess that the Genesis is one of the most significant access marketplaces anywhere in the world," said Rob Jones, the NCA's Director General of Threat Leadership.

The NCA estimated that the service hosted about 80 million credentials and digital fingerprints stolen from more than 2 million people.

U.S. Justice Department Deputy Attorney General Lisa Monaco in a statement said many of the forum's users were arrested on Tuesday. A senior FBI official said arrests had been made in the United States but declined to provide further details. The investigation into Genesis is still ongoing.

The U.S. Treasury Department in a statement announcing sanctions against the market called it "one of the most prominent brokers of stolen credentials and other sensitive information."

British authorities said 17 countries were involved in the operation, which was led by the FBI and Dutch National Police and resulted in about 120 arrests, more than 200 searches and almost 100 pieces of "preventative activity."

Qintel did not immediately return messages seeking comment and Reuters could not immediately locate contact details for Genesis Market's administrators, which the U.S. Treasury said were believed to operate from Russia.

Genesis specialized in the sale of digital products, especially "browser fingerprints" harvested from computers infected with malicious software, said Louise Ferrett, an analyst at British cybersecurity firm Searchlight Cyber.

Because those fingerprints often include credentials, cookies, internet protocol addresses and other browser or operating system details, they can be used by criminals to bypass anti-fraud solutions such as multi-factor authentication or device fingerprinting, she said.

The site had been active since 2018.

The NCA said Genesis had operated by selling credentials from as little as 70 cents to hundreds of dollars depending on the stolen data available.

"To get up and running on this you just have to know of the site, potentially be able to get yourself an invite which given the volume of users probably wouldn't be particularly difficult," said Will Lyne, NCA Head of Cyber Intelligence. "Once you become a user, it's really easy to then ... perpetrate criminal activity."

The NCA said countries involved in the investigation included Australia, Canada, Denmark, Estonia, Finland, France, the United States, the UK, Germany, Iceland, Italy, New Zealand, Poland, Romania, Spain, Sweden and Switzerland.

"The Genesis Market lowered the barrier to entry for ransomware groups and allowed many cybercriminals to swiftly scale their operations and carry out targeted attacks for immediate financial benefit," said John Fokker, head of threat intelligence for U.S. cybersecurity firm Trellix. "Without even factoring in the arrests of Genesis Market members, simply removing this immense cybercriminal marketplace from the web will significantly slow down cybercriminal activity."

People can check if they were

(Reporting by James Pearson and Michael Holden; Writing by Raphael Satter; Editing by Sandra Maler, Christina Fincher, Mark Porter and Jonathan Oatis)

CTVNews.ca Top Stories

We've all had neighbours we didn't like, but two people from Sault Ste. Marie have been awarded more than half a million dollars for the 'extreme' behaviour of the people who lived next to them.

An 18-year-old woman who allegedly stole a Porsche and then ran over its owner in a caught-on-video incident in Mississauga earlier this month is now facing auto theft charges in Toronto.

Local Spotlight

An ordinary day on the job delivering mail in East Elmwood quickly turned dramatic for Canada Post letter carrier Jared Plourde. A woman on his route was calling out in distress.

Fire has destroyed a barn and 17,000 plants at a family-owned business in Lower Coverdale, N.B.

Before influencers on social media, Canada’s Jeanne Beker was bringing the world of high fashion down to earth and as Calgary’s Glenbow Museum gets a major make-over, it will include a new exhibition showcasing the pop culture icon.

A sea lion swam free after a rescue team disentangled it near Vancouver Island earlier this week.

A Nova Scotian YouTuber has launched a mini-truck bookmobile.

Cole Haas is more than just an avid fan of the F.W. Johnson Wildcats football team. He's a fixture on the sidelines, a source of encouragement, and a beloved member of the team.

Getting a photograph of a rainbow? Common. Getting a photo of a lightning strike? Rare. Getting a photo of both at the same time? Extremely rare, but it happened to a Manitoba photographer this week.

An anonymous business owner paid off the mortgage for a New Brunswick not-for-profit.

They say a dog is a man’s best friend. In the case of Darren Cropper, from Bonfield, Ont., his three-year-old Siberian husky and golden retriever mix named Bear literally saved his life.