The General Public Prosecutor’s Office in Frankfurt am Main – Central Office for Combating Internet Crime (ZIT) – and the Federal Criminal Police Office (BKA), together with law enforcement authorities from the USA, Australia, Spain, Greece, Romania, Italy and France, took action against the two largest trading platforms for cybercrime on the internet in the period from 28-30 January 2025. These were the websites ‘nulled.to’ and ‘cracked.io’, which were set up as forums for cybercrime services and thus represented important entry points into the shadow economy of the cybercrime phenomenon, known as the ‘underground economy’.
As part of the internationally coordinated Operation Talent, led by the German authorities and with the involvement of Europol, a total of seven search warrants were executed, 67 devices, including 17 servers, twelve accounts and twelve domains used for criminal purposes, were seized in ten countries, and the platforms were shut down. In addition, a payment service provider and a hosting service that were directly linked to the platforms’ economic network were taken offline.
The websites ‘nulled.to’ and ‘cracked.io’ were the two largest underground e-commerce platforms on the internet, with around five million registered user accounts each, since 2015 and 2018 respectively. The platforms were linked by the same administrators, which was evident from their similar technical and structural design. Both websites were organised as forums where criminal offers in the categories DDoS (Distributed Denial of Service), malware, cracking & hacking tools or leaks could be placed and accessed. For example, programmes that can be used to prepare or carry out hacking attacks or to publish data stolen from institutions and companies were frequently traded. In addition, these forums offered AI-based tools and scripts that could automatically detect security vulnerabilities or optimise attacks. Phishing techniques were also shared that used AI to create personalised messages. The suspects most recently generated an annual turnover of more than one million euros from operating the two platforms.
In the course of the investigations, which have been ongoing since March 2024, a total of eight people have been identified as having been directly involved in operating the criminal trading platforms, including two German citizens aged 29 and 32 who live in the district of Segeberg (Schleswig-Holstein) and in Valencia (Spain). The two German suspects are suspected of operating criminal trading platforms on the internet for commercial gain in accordance with § 127 of the German Criminal Code, which, if convicted, carries a prison sentence of between six months and ten years. The other suspects, a woman aged 27 and men aged between 21 and 29, will have to answer to the American, Spanish, Greek and Italian law enforcement authorities under their respective jurisdictions. A total of two people, including a German citizen, were arrested. In addition, assets in the mid-six figures were secured.
In the course of the law enforcement actions, the IT infrastructures of the criminal platforms were also secured. The data secured, such as email addresses, IP addresses and communication histories of the more than 10 million registered user accounts, are the basis for further international investigations against criminal vendors and users of the platforms.
Further information on Operation Talent is available on the BKA website at the following link: www.bka.de/nulled-cracked
