DarkOwl Profiles ZeroForums, a New Chinese-Language Cybercrime Forum
Summary
DarkOwl’s investigation describes ZeroForums’ forum structure, administrator, and linked Telegram channels, including 96 files of alleged breaches. It reports that the forum’s apparent hosting IP was identified; advertised breach claims remain unverified.
Key points
- ZeroForums defaults to Simplified Chinese, offers an English interface, and resembles established cybercrime forums in its design and registration process.
- The forum had 70 registered members, 16 topics, and 32 posts when DarkOwl compiled its findings.
- Administrator Admineirunk shared alleged breach content, including posts referencing U.S. gaming data and Chinese student data.
- An administrator-linked Telegram notification channel had 6,451 subscribers; a newer channel had shared 96 files of alleged data breaches.
- A linked Telegram bot reported 767 monthly active users. The forum’s onion site was inactive at the time of the report.
- DarkOwl says the forum’s real IP address appeared to be identified despite Cloudflare use and other OPSEC measures; geolocation indicated a U.S.-based server.
- DarkOwl stated that advertised breach claims were not independently verified.
Article Details
- Attack Vectors
- ZeroForums and its associated Telegram channels were used to share alleged data-breach material; DarkOwl says the authenticity of the breach claims was not independently verified.
- The forum was promoted through Telegram channels and a linked bot.
Threat Actors
Vendors
Products
DarkOwl Visionacross both its on-platform subforums and associated Telegram channels has been captured through DarkOwl Vision, ensuring early identification and indexing of any alleged breach material distributed through thisTelegramand sharing of alleged data leaks and breaches across both its on-platform subforums and associated Telegram channels has been captured through DarkOwl Vision, ensuring early identification and indexing of anyZeroForumsA newly emerged dark web forum known as “ZeroForums” has been identified, operating with a user interface closely mimicking established cybercriminal platforms including BreachForums and RaidForums.