US and Dutch law enforcement agencies have taken down 39 domains and their associated servers to disrupt a network of malicious online marketplaces linked to Pakistan that were primarily enabling BEC attacks . The police operation took place on January 29, 2025 and is codenamed Operation Heart Blocker.
The malicious sites sold phishing toolkits and hacking tools to cybercriminals. The sites were operated by a group known as Saim Raza (or HeartSender). They had been active since at least 2020.
The malicious services provided by the marketplaces were used by international organized crime groups to target numerous victims in the United States in BEC attacks. These attacks resulted in losses of over $3 million.
See also: Authorities shut down hacking forums Cracked.io and Nulled.to (Greece also participated)
“ Saim Raza’s websites operated as marketplaces that advertised and facilitated the sale of tools such as phishing kits, scam pages, and email extractors, which are often used to create and maintain fraud operations ,” the US Department of Justice (DoJ) said
According to the charges, the Saim Raza group not only offered the malicious tools online, but also trained end users on how to use the tools against victims. It provided instructional videos on YouTube on how to use these malicious programs, helping even cybercriminals who were not as technically savvy.
The advertised tools also allowed the collection of victims' credentials , which were then used to promote the scams, the DoJ added.
In a coordinated statement, Dutch police officials said the criminal group sold various programs to facilitate digital fraud. It sold useful tools to cybercriminals to carry out BEC attacks and steal credentials and other data. The service is estimated to have had thousands of customers before its shutdown.
See also: Pirate sports service Markkystreams shut down
Users can check if they are among those affected by credential theft by going to the URL “www.politie[.]nl/checkjehack” and entering their email addresses.
The group, also referred to as The Manipulators, was first exposed by security journalist Brian Krebs in May 2015.
“While they lack the technical sophistication of many other large cybercrime vendors, their most notable feature is that they are one of the first cybercrime marketplaces to focus on phishing, while also spreading their operations across multiple distinct branded shops,” the company said.
“Evidence suggests that new members have joined and at least one long-time member of The Manipulators has left the group. They appear to have a physical presence in Pakistan, including Lahore, Fatehpur, Karachi, and Faisalabad.“.
The removal of the 39 domains and malicious marketplaces is a major victory in the fight against illegal online marketplaces, but the problem remains large. These underground sites are constantly evolving and adapting, making it difficult to completely eliminate them. As soon as one is shut down, another appears in its place. Constant vigilance, international cooperation and the use of sophisticated technologies to stay ahead of the criminals operating on the dark web.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Authorities shut down malicious marketplace Rydox – Three arrests
Only through a combination of these efforts can we hope to have a significant impact and reduce the harm caused by illegal online activities. With each new operation and arrest, we are getting closer to creating a safer online environment for everyone. It is important that authorities remain committed to this goal and continue to work together to dismantle these criminal networks.
Source: thehackernews.com
