Security

Cyber-crime

Cops arrest suspected admin of German-language crime bazaar

Drugs, botnets, forged docs, and more generated fortune for platform sellers


German authorities say they have again shut down the perhaps unwisely named Crimenetwork platform and arrested a suspected admin.

An unnamed 29-year-old man was taken into custody by the Federal Criminal Police Office (BKA) and the Frankfurt prosecutor's office's cybercrime unit (ZIT) on Tuesday. Cryptocurrency worth around €1 million ($1.05 million) was also seized.

Alongside accusations of being the technical administrator of the site, he faces charges related to dealing large amounts of drugs, say authorities.

Crimenetwork spun up as early as 2012 and unlike most of its counterparts, its initial access points existed on the clear web using various URLs over the years. It is now unavailable, with users claiming "funds and onion addresses" have been seized by the authorities. The BKA said it recently had more than 100 registered sellers serving more than 100,000 mainly German-speaking users.

The platform was used to buy illegal goods and services, such as stolen data, narcotics, weapons, botnets, and forged documents, the BKA said – again similar to its darkweb counterparts. Buyers also paid using cryptocurrencies, including Bitcoin but mainly Monero.

Between 2018 and 2024, the platform facilitated sales exceeding €90 million ($94.5 million), with admins scooping up a cut of each sale, thought to be in the region of 1-5 percent. Admins also received monthly payments from sellers for the right to list and advertise their illicit wares on the platform.

As has become trendy among Eurocops throughout this year, such as with Operation Cronos and Endgame, the BKA put together and published a retro-style video teasing additional information about the case that wasn't included in its press materials.

In the video, hosted on the new bustedcrime.network domain, the BKA hinted at having access to site data including communications, user details, sales, and transaction data. 

The latest action follows a lengthy operation carried out in 2017 that saw 1,000 officers raid 120 premises across Germany, again related to Crimenetwork.

The raids were the final stage of the four-month operation, which largely consisted of police combing through over a million posts and private messages of more than 260 users of the site. That analysis identified 153 total suspects, including 11 administrators.

At the time, only two arrests came of the operation, both in Saarland, according to Deutsche Welle. One was a 20-year-old accused of 452 counts of computer fraud, while a 33-year-old was charged with selling sexual potency substances.

The investigation was used as a case study supporting the implementation of a common data-sharing and evaluation portal that could be used securely by authorities nationwide to expedite outcomes. Since then, Europol has developed various platforms to this effect to support cross-border information exchange.

Larger-scale raids were carried out across Germany and surrounding nations in 2020 after Crimenetwork spun up again following its initial shuttering three years earlier. It involved scouring 232 premises in 15 of Germany's 16 states, as well as regions of Austria and Poland.

Thirty-two people were arrested, 11 of whom were held in custody. Law enforcement said a suspected 26-year-old admin was arrested a year earlier for a separate charge upon re-entering the country. ®

Send us news
24 Comments

Lights out for 18 more DDoS booters in pre-Christmas Operation PowerOFF push

Holiday cheer comes in the form of three arrests and 27 shuttered domains

How Androxgh0st rose from Mozi's ashes to become 'most prevalent malware'

Botnet's operators 'driven by similar interests as that of the Chinese state'

What do ransomware and Jesus have in common? A birth month and an unwillingness to die

35 years since AIDS first borked a PC and we're still no closer to a solution

Suspected LockBit dev, facing US extradition, 'did it for the money'

Dual Russian-Israeli national arrested in August

Don't fall for a mail asking for rapid Docusign action – it may be an Azure account hijack phish

Recent campaign targeted 20,000 folk across UK and Europe with this tactic, Unit 42 warns

Phishers cast wide net with spoofed Google Calendar invites

Not that you needed another reason to enable the 'known senders' setting

Critical security hole in Apache Struts under exploit

You applied the patch that could stop possible RCE attacks last week, right?

Ransomware scum blow holes in Cleo software patches, Cl0p (sort of) claims responsibility

But can you really take crims at their word?

Deloitte says cyberattack on Rhode Island benefits portal carries 'major security threat'

Personal and financial data probably stolen

Are your Prometheus servers and exporters secure? Probably not

Plus: Netscaler brute force barrage; BeyondTrust API key stolen; and more

Iran-linked crew used custom 'cyberweapon' in US critical infrastructure attacks

IOCONTROL targets IoT and OT devices from a ton of makers, apparently

Android beefs up Bluetooth tag stalker protections

Wider ecosystem still has work to do, though