The Darkode malware sale and exchange forum has returned two weeks after being shut down by the FBI.
The English-language forum, founded in 2007, has since become a major player in the cybercrime underground, as its members sell and buy zero-day exploits, malware, trojans, and stolen credit card numbers.
The website stopped functioning at the beginning of the month, when the FBI and the European Cybercrime Centre took it offline, stating that at least 28 users and administrators from 20 countries had been arrested.
But today the forum appears to be back online. In fact, Darkode's administrator, also known as Sp3cial1st, confirmed the new website's credibility to researcher MalwareTech.
The researcher confirmed that Sp3cial1st revealed information that only the two of them knew. “It’s definitely legit,” says MalwareTech.
The domain Darkode.cc is operating normally as of today, and already has most mods and senior members registered. It also uses the Tor routing service to provide its users with unique website addresses, as Sp3cial1st notes on the new site.
“It appears that the raids focused on individuals who were added recently or those who have withdrawn from the scene for many years”, says Sp3cial1st.
“The forum will be on the onion, and will be accessible only by invitation, first to members we can confirm are still active.”
“Each user will have their own onion, and an identity on the forum, which will be created via the Blockchain API.”
Sp3cial1st also notes that the new forum will store only a hash of the user's BTC identity, a wallet, and a nickname.
The administrator warns that anyone claiming to be a member who has not been invited is a fraud, and that all users who joined the old Darkode in the last eight months should be considered traitors aka untrustworthy.
We should, of course, note that this activity, two weeks after the forum's closure, is quite suspicious. Moreover, the FBI's technique of creating honeypots and waiting for interested parties is well known.
