BreachForums Shutdown: What Happens Now?

BreachForums, which was dubbed as one of the most popular hacking and data leak forums this year, shut down on March 20, 2023. The site closed after the arrest of its admin, Conor Brian Fitzpatrick (known as ‘pompompurin’). Baphomet, the remaining admin, claimed that law enforcement had gained access to the forum’s servers, and ultimately, he decided to shut it down. 

BreacheForums served as the successor to RaidForums, another widely known hacking forum that was seized and closed by the FBI in April 2022 after the arrest of its founder, Omnipotent, in the UK.

The image below shows the announcement that is believed to be made by Baphomet, on the BreachForums’ official channel on Telegram, in which he declares that the forum was about to permanently shut down.

A short background about BreachForums

• What kind of site is it? BreachForums was a popular dark web forum that focused on cybercrime; It became a significant platform for the trade of illicit content.
• What content did it host? The site hosted a wide range of content including discussions on data breaches, hacking, phishing, exploits, and financial fraud. Its users frequently engaged in trading various forms of stolen personally identifiable information (PII) such as databases, documents, and compromised accounts, which include email addresses, passwords, and credit card details.
• Who used this forum? The forum was used by threat actors and cybercriminals.
• How many members did it have? BreachForums used to have more than 255K registered users.

Is the content from BreachForums gone?

Despite the shutdown of BreachForums and the seizure of Raidforums, databases from those forums are still accessible through alternative top hacking forums such as XSS and Exploit. The next image shows an example of a post from XSS forum, where a user shared a list of hundreds of files from BreachForums and RaidForums.

Where are BreachForums users going after the shutdown?

The cyber threat intelligence (CTI) community is eager to know which website will replace BreachForums. To answer this question, we need to first investigate where BreachForums’ users will migrate to in the near future.

Using our Cyber API, we have identified two potential answers to this questions: 

• Users may turn to existing top forums that offer similar activities to the ones BreachForums provided
• Users may join new dark web forums that are seeking to replace BreachForums

Let’s take a closer look at each of these two options:

1# Users are shifting to existing top forums

We have seen some users who have shifted their activity from BreachForums to other popular hacking forums such as XSS, Exploit, Cracked, Nulled, etc.

To better identify the forums that users moved to, we tracked the activity of users that used to be active on BreachForums. For example, we saw that a user named “reizinho” was active on BreachForums, and then after the shutdown, he created a thread on Exploit to welcome old BreachedForums members.

2# Users joining new sites

We used our Cyber API to conduct comprehensive research of the deep and dark web to identify alternatives to BreachForums – just as BreachForums previously took the place of RaidForum. This trend of new forums attempting to replace a popular platform that shut down is illustrated by a comment made by a user on XSS:

What are the new alternative sites?

We have identified the most promising alternative sites to BreachForums to date which we’re listing for the first time here:

LeakBase

A threat group known as ARES launched a new hacking forum called LeakBase on April 9th, 2023. This forum provides free databases, a marketplace for trading stolen data, and an escrow payment system to build trust. 

It also includes various discussion areas on hacking-related topics such as programming, tips, tutorials, and methods to bypass security measures. Although it is still relatively new, LeakBase is gaining popularity and may soon become a prominent platform for cybercriminals. It is thought that ARES is taking advantage of the shutdown of BreacheForums to accelerate its growth and establish its position in the market.

RAID FORUM

A new hacking forum was established in April 2023 with a name that resembles the well-known RaidForums that was seized in April 2022. However, there is no indication that the admins of the new forum have any connection to the former. The forum contains various categories, including discussions on hacking and leaks, as well as marketplace and tutorial sections. As of now, the forum has accumulated 1,725 members since its launch on April 9, 2023.

BreachForums – what’s next?

The closure of BreacheForums has impacted the cybercriminal community and challenged threat actors to find new alternatives. While it may have temporarily disrupted the trade of stolen data and hacking discussions, the emergence of new forums such as LeakBase and RAID FORUM indicates that the demand for such platforms continues. So far, we have already seen users migrating to other top hacking forums like XSS and Exploit. This is another example of why monitoring the dark web in general, and more specifically platforms on the deep and dark web plays a key role in keeping the cybersecurity community ahead of evolving threats and sources.