A leading marketplace on the dark web, Solaris, has been hit by a rival, according to crypto analytics company Elliptic. The Russia-linked platform, which tried to occupy space vacated by the busted Hydra, is believed to have conquered up to a fifth of the illicit market before the hack.

Solaris Allegedly Taken Over by Darknet Marketplace Called Kraken

Solaris, a major marketplace for drugs and other illicit products, has been targeted in a hacking attack carried out by a similar enterprise, Kraken, not to be confused with the well-known cryptocurrency exchange with the same name.

After in April last year law enforcement authorities shut down Hydra, the former leader in this business, seizing its servers in Germany and arresting an alleged operator in Russia, Solaris managed to gain between 20% and 25% market share, according to estimates quoted by Elliptic.

This week, the blockchain forensics company reported that since Friday, Jan. 13, those who visited the onionsite were being transferred to Kraken. The latter claimed to have taken control over the infrastructure, Gitlab repository and source code of Solaris and blocked its bitcoin wallets.

Kraken is another player in the dark web space and, like Solaris and Hydra, is targeting the Russian-language segment of the underground market. The illegal trading platforms are suspected of having other ties to Russia as well.

For example, Solaris is believed of have used the services of one of the Russian “patriotic” hacker groups. The pro-Kremlin Killnet is known for launching distributed denial-of-service (DDoS ) attacks on Ukraine after Russia invaded the country in late February, 2022.

This isn’t the first attempt to breach Solaris. Ukrainian-born cyber intelligence expert Alex Holden claimed to have hacked into the marketplace, according to a report in December, and getting hold of some of the bitcoin sent to dealers using the site and to its owners.

Helped by his cybersecurity company, Holden said he specifically targeted a wallet used for crypto exchange transactions and was able to divert 1.6 BTC. The cryptocurrency was later donated to a Kyiv-based charity.

What do you make of the darknet market Kraken’s hacking attack on rival Solaris? Share your thoughts on the subject in the comments section below.

A Ukrainian living in the U.S. has reportedly hacked a major drug market on the Russian dark web, diverting some of its crypto proceeds. The man says he donated the digital cash stolen from the illicit website to an organization delivering humanitarian aid across his war-torn homeland.

Wisconsin Resident With Ukrainian Roots Hacks Russian Dark Web Market Solaris

Ukrainian-born cyber intelligence expert Alex Holden, who left Kyiv as a teenager in the 1980s and now lives in Mequon, Wisconsin, claims he has hacked into Solaris, one of Russia’s largest online drug markets, Forbes informs in a report.

Supported by his team at Hold Security, he was able to get hold of some of the bitcoin sent to dealers and the darknet site’s owners. The cryptocurrency, worth over $25,000, was later transferred to Enjoying Life, a charitable foundation based in the Ukrainian capital.

Without revealing exactly how he did it, Holden explained he took control of much of the internet infrastructure behind Solaris, including some administrator accounts, obtained the website’s source code and a database of its users and drop off locations for drug deliveries.

For a while, the Ukrainian and his colleagues also gained access to the “master wallet” of the marketplace. It was used by buyers and dealers to deposit and withdraw funds and operated as the platform’s crypto exchange, the article details.

Given the rapid turnover, the wallet rarely had more than 3 BTC at a time. Holden managed to appropriate 1.6 BTC and send it to Enjoying Life. Hold Security donated another $8,000 to the charity, which provides assistance to people affected by the war in Ukraine.

Solaris Linked to ‘Patriotic’ Russian Hacking Collective Killnet

The darknet market Solaris is suspected of having connections to the hacking crew Killnet, which after Moscow launched its invasion in late February became one of Russia’s “patriotic” hacker groups vowing to target Ukrainians and their supporters.

Killnet has also conducted a number of attacks in the U.S., including on airport and state government websites as well as the National Geospatial-Intelligence Agency. It reportedly hit the Eurovision song contest, the Estonian government and Italy’s National Health Institute.

The group was also blamed for attacking Rutor, the main rival of Solaris, which became Russia’s leading underground drugs market after Hydra was shut down this past spring. According to U.S. cybersecurity firm Zerofox, Solaris was paying Killnet for DDoS services.

Besides the battlefield, Russia and Ukraine have also clashed in the online space, with the government in Kyiv recruiting experts for its own cyberforce. The special unit was tasked to identify and prevent Russian attacks but also hack back.

Hits such as those on Russia’s largest bank, Sber, and the Moscow Stock Exchange have been attributed to the Ukrainian IT army. Social media accounts associated with the hacktivist collective Anonymous took responsibility for many other attacks.

What do you think about Alex Holden’s attack on the Russian darknet market Solaris? Let us know in the comments section below.

Law enforcement in Russia has blocked major sites on the dark web, including a carding market leader. The platforms have been seized amid ongoing investigations into hacking groups, with Russian authorities ramping up efforts to dismantle the cybercrime rings and detain their members.

Interior Ministry of Russia Hits Stolen Credit Cards Market

The Ministry of Internal Affairs of the Russian Federation (MVD) has brought down four prominent websites operating on the dark web, blockchain forensics firm Elliptic has revealed. The sites have been blocked by Directorate “K”, MVD’s unit combatting computer-related crime.

The seized platforms are the Sky-Fraud forum, Trump’s Dumps, UAS Store, and Ferum Shop, which became the leading market for stolen credit cards after the largest marketplace in the niche, Unicc, was taken offline in January, the report details.

According to Elliptic’s estimate, the sites have collectively made more than $263 million in crypto sales denominated in bitcoin (BTC), ether (ETH), and litecoin (LTC) before they were shut down. Ferum accounts for the bulk of that amount with $256 million in bitcoin generated, or 17% of the carding market.

Trump’s Dumps, another website distributing compromised card data, has allegedly made around $4.1 million since its launch in 2017. Both sites were advertised on the on Sky-Fraud forum, where carding techniques and money laundering tips were among the main topics. Directorate “K” has apparently left a message in its source code, reading: “Which one of you is next?”

[#Russia] SKY-FRAUD & FERUM, famous Russian #carding forums closed by Russian authorities.

Authorities left an easter egg on the code source saying “WHICH ONE OF YOU IS NEXT?”#cybercrime #takedown #infosec #banking pic.twitter.com/RbNTkWPHIc

— Soufiane Tahiri (@S0ufi4n3) February 7, 2022

The fourth blocked website, UAS Store, was a platform offering stolen remote desktop protocol credentials that cybercriminals use to gain access to victims’ accounts from other devices. These breaches have increased during the Covid-19 pandemic as more employees are now working from home. Since late 2017, UAS Store has made around $3 million in cryptocurrency.

Elliptic notes that the latest seizures have been executed after the previous top carding marketplace, Unicc, and its affiliate proxy market Luxsocks, became inaccessible in mid-January. The seizures also came after the subsequent arrest of Unicc’s suspected administrator by the Russian Federal Security Service (FSB). Researchers claim the crypto proceeds of the two platforms reached $372 million.

Meanwhile, the MVD has sought through a Moscow court the arrest of six unidentified hackers accused of “illegal circulation of means of payment.” Whether the group is linked to the closed-down dark web sites is not clear yet. Last month, FSB and MVD busted the notorious Revil ransomware group on a U.S. request, detaining 14 of its suspected members.

Do you think Russia will continue to crack down on dark web platforms and hacking groups? Tell us in the comments section below.

Russian institutions have responded to a call from а public movement for joint efforts to identify cryptocurrency transfers related to drug trade. The anti-drug organization, Stopnarkotik, recently asked the interior ministry and the central bank to investigate alleged connections between U.S.-sanctioned crypto exchange Suex and a darknet market operating in the region.

Russian Authorities Respond to Stopnarkotik’s Request for Action Against Drug Trade

The Ministry of Internal Affairs of the Russian Federation (MVD) and Bank of Russia have agreed to cooperate with the All-Russian Public Movement Stopnarkotik on identifying financial flows involving cryptocurrencies obtained as a result of drug sales. The Russian online news portal Lenta.ru reported on the agreement, quoting a letter from a high-ranking MVD official.

The letter signed by Major General Andrei Yanishevsky, head of the Drug Control Department at the Interior Ministry, has been issued after a working meeting with representatives of the anti-drug organization. It comes in response to Stopnarkotik’s call for the two institutions to carry out an investigation focused on Suex, a Russia-based OTC crypto broker, and its links to other companies and banks.

In September, the U.S. Treasury Department blacklisted the Czech-registered entity Suex OTC s.r.o. which operates out of physical offices in Moscow and Saint Petersburg. The crypto platform is suspected of processing hundreds of millions of dollars in coin transactions related to scams, ransomware attacks, darknet markets, and the infamous Russian BTC-e exchange.

Since launching in 2018, Suex is believed to have received over $481 million in BTC alone. Close to $13 million came from ransomware operators such as Ryuk, Conti, and Maze, over $24 million was sent by crypto scams like Finiko, $20 million came from mixers, and another $20 million from darknet markets such as the Russia-targeting Hydra, blockchain forensics firm Chainalysis detailed in a report.

In its request to the Russian authorities, following the announcement of the U.S. sanctions, Stopnarkotik noted that Suex had been “involved in money laundering for the largest drug-selling platform.” The organization pointed out that the market’s drug trafficking in the Russian Federation amounts to an estimated $1.5 billion a year or more.

It also mentioned the name of one of Suex’s co-founders and highlighted its alleged connections with other crypto companies and financial institutions such as Exmo, a major digital asset exchange in Eastern Europe, financial services company Qiwi, a leading payment provider in Russia and the CIS countries, as well as the Ukraine-based Concord Bank.

Stopnarkotik asked Bank of Russia to provide its assessment on the matter, check if the operations of Suex and other entities are being conducted in accordance with the law in Russia, and consider blocking Russian payments to a Ukrainian organization.

“We received a response from the Ministry of Internal Affairs and the Central Bank. We also had a personal meeting with the Ministry of Internal Affairs so that they had an understanding of how we receive information, including about money laundering,” the movement’s chairman, Sergei Polozov, has been quoted as saying. He added that the Russian Interior Ministry is ready to accept Stopnarkotik’s data and work together with the organization.

Do you expect the cooperation between Stopnarkotik and Russian government institutions to develop further? Tell us in the comments section below.