The Ukrainian Secret Service (SSU) announced the arrest of a hacker known as Sanix, who was selling billions of stolen credentials on hacking forums and Telegram channels.
The SSU says it arrested Sanix in Ivano-Frankivsk, a city in western Ukraine. However, authorities have not publicly announced the hacker's real name.
The hacker has been linked to hacking forums in the past. His activities were first detected in 2018.
Sanix is what security experts call a “data broker.” It collected leaked data from compromised companies and put the information into large lists of usernames and passwords.
The hacker then resold the data to other cybercriminals , such as spam groups, password crackers, account hijackers, and brute-force botnet operators.
Sanix, who operated under the alias “Sanixer” on Telegram, is the person responsible for the combination of usernames and passwords known as Collection #1, #2, #3, #4, #5, Antipublic , etc. These collections were massive and included billions of unique credentials.
These collections were secretly sold for years. However, according to security IntSights, some of these collections were leaked online after a dispute with another data broker, Azatej. Azatej is the person behind Infinity Black, a web portal for selling stolen accounts.
At the time, in January 2019, the Azatej/Sanix leaks caught the media’s attention and introduced the world to the concept of “combolists.” These are large collections of old data that have been turned into a commodity for hackers. Today, Collection #1 even has its own page on Wikipedia.
Azatej, who first leaked Collection #1 and then the other collections, was arrested by Europolearlier this month in Poland, along with other members of Infinity Black.
In a press release, SSU said it found copies of Collection #1 on computer , along with "at least seven similar databases of stolen and 'cracked' passwords."
In addition to these databases, Ukrainian authorities reported that the hacker's computer also contained PIN codes for bank cards, cryptocurrency wallets, PayPal account credentials, and DDoS botnets.
SSU officers said they seized 2TB of data, as well as $3,000 and ₴190,000 from Sanix's residence after searching his home.
Below is a video of the moment the house was searched and the hacker was arrested. The video was released by Ukrainian authorities.
