Genesis Market, a major stolen credentials marketplace, appears to be in operation once again, despite the law enforcement agencies’ claim about the shutdown of the platform last month, BBC reports.
In April, an international police operation dubbed “Operation Cookie Monster” seized several domain names linked to Genesis Market, thus removing the platform from the mainstream internet. In addition, 119 suspects had been arrested in the US, Canada and across Europe.
However, cybersecurity experts say that the website was only disrupted for about two weeks and the “twin” dark web version of the market remains online and “is fully functional.”
According to Cyril Noel-Tagoe, principal security researcher at cybersecurity firm Netacea, the darknet website and malicious software infrastructure have survived the takedown, and Genesis Market’s administrators are still remain at large.
The market’s admins announced the release of a new version of their specialist hacking browser, resumed collecting data from hacked devices and added more than 2,000 new victim devices to the market.
“It is true that the Genesis administrators quickly responded on Exploit [hacker] forums stating that they would be back online shortly with improvements,” John Fokker, head of threat intelligence at cybersecurity company Trellix told BBC.
Despite Genesis Market's continued presence, the UK's National Crime Agency says that the operation has dealt a “huge blow” to cybercriminals.
“Although a dark web version of the site remains active, the volume of stolen data and users has been significantly reduced. I have no doubt that the operation damaged criminal trust in Genesis Market,” Paul Foster, deputy director of the NCA's National Cyber Crime Unit, told the BBC.