A new development in the case of one of the major illegal online cybercrime marketplaces is being recorded in the United States. Ardit Kutleshi, from Kosovo, pleaded guilty to his role in creating and operating Rydox, a platform used to buy and sell stolen personal data, credentials and tools that could be exploited for online fraud and identity theft.
The development comes almost two years after the authorities’ operation that led to the closure of Rydox and the arrests of its administrators. The case also highlights the way the international cybercrime-as-a-service market now operates, where criminals can buy data and tools without having to develop the necessary expertise themselves.
A "market" for cybercrime
According to court documents, Rydox was operating since at least February 2016 and remained active until authorities took over in 2024. During that time, more than 7,600 transactionsinvolving stolen personal information (PII), login credentials, and other cybercrime-related products and services.
The transactions netted the platform at least $232,000, according to the latest announcement from the US Department of Justice. The data that was trafficked included victims in the US, creating the conditions for further fraud, identity theft and unauthorized access to accounts.
See also: Bitget: Cold wallets secure after 351.6 million breach.
The interesting thing is that Rydox wasn't limited to selling stolen data. It acted as a broader ecosystem for criminals, offering access to tools and services that could be used to carry out new attacks.
More than 321,000 cybercrime products
The scale of the platform is made even more apparent by the number of products being traded. According to the case data, Rydox offered more than 321,000 cybercrime products and tools to more than 18,000 users.
This operation is similar to a commercial online platform, except that the products being traded are intended for illegal activities. The existence of such marketplaces lowers the technical barrier for would-be criminals, as a user does not necessarily need advanced knowledge to gain access to stolen data or tools.
This is one of the reasons why authorities treat such platforms as cybercrime infrastructures and not simply as individual websites.
How payments worked
Rydox used cryptocurrencies as the primary means of payment for purchases on the platform.
At the same time, there was an organized model for sellers themselves. Users who wanted to become an authorized seller paid a one-time fee, while the revenue from transactions was shared between the seller and the platform.
In this way, Rydox did not simply function as a place where someone could post an illegal product. It had the characteristics of an organized marketplace, with a mechanism for seller registration, payments, and commission.
See also: Australia: OpenAI agent hacked Medicare statistics portal
International operation with infrastructure seizures
The dismantling of Rydox was the result of cooperation between authorities from many countries. In December 2024 , Ardit and Jetmir Kutleshi were arrested in Kosovo , while Shpend Sokoli was arrested in Albania by SPAK . The operation also involved services from Kosovo, the United States, and Malaysia.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The US authorities also proceeded with a judicial seizure of the Rydox.cc, while infrastructure associated with the platform's operation was also seized. This move aimed not only to remove the website from the internet, but also to prevent the continuation of transactions through this specific infrastructure.
Ardit Kutleshi was extradited to the United States in 2025 and pleaded guilty to identity theft and conspiracy to commit money laundering on September 22, 2026. The guilty plea announcement was made public by the U.S. Department of Justice on September 24.
What punishment does he face?
Sentencing is scheduled for February 9, 2027.The identity theft charge carries a mandatory minimum sentence of two years, while the money laundering conspiracy carries a maximum sentence of 20 years. The final sentence will be determined by the federal court, taking into account relevant guidelines and statutory factors.
The Rydox case is yet another example of the effort of international authorities to tackle cybercrime by hitting not only the ultimate perpetrators, but also the infrastructures that supply them with data and tools.
See also: Hackers use Chrome-Windows zero-days to develop CLEANGULP
This strategy is particularly important in an environment where stolen personal data, credentials, and attack tools can quickly be transformed into new fraud scenarios. As more of these markets are disrupted, it becomes more difficult for criminals looking for ways to carry out attacks without having to build all the necessary tools themselves to access ready-made infrastructure
source: www.bleepingcomputer.com
