BreachForums Returns After FBI Seizure as Users Speculate About Law-Enforcement Honeypot
Summary
The FBI seized BreachForums and linked Telegram channels on May 15, 2024. A new forum appeared on May 23, while users speculated—without confirmation—that it was a law-enforcement honeypot.
Key points
- The FBI seized BreachForums on May 15, 2024, and announced it had taken control of Telegram channels linked to administrator Baphomet.
- BreachForums had previously been seized after the 2023 arrest of its earlier administrator, Pompompurin; the article describes a history of successor forums trading stolen data and access.
- The forum returned at a new onion address on May 23 under ShinyHunters’ announcement. It initially limited access to existing accounts, then opened registration.
- Users speculated that the new forum was a law-enforcement honeypot, but the article provides no confirmation.
- Europol confirmed that data posted as belonging to its EC3 group came from Europol, while saying no sensitive information was stolen.
- Telegram channels remained active amid unconfirmed rumors that Baphomet had been arrested; DarkOwl said it would continue monitoring the forums and possible successors.
Article Details
- Event Type
- Law-enforcement seizure of BreachForums and associated Telegram channels, followed by the forum’s return under a new onion address.
- Impact
- The FBI seized BreachForums on May 15, 2024, and announced control of Telegram channels linked to administrator Baphomet. The forum had been used to trade stolen data, sell corporate access, and share malware and stealer logs. The article reports that leaks involving organizations including AT&T, 23andMe, T-Mobile, and Europol appeared on the site; Europol confirmed data was from it but said no sensitive information was stolen. BreachForums returned by May 23, while speculation about arrests and whether the new site was a law-enforcement honeypot remained unconfirmed.
People
Connor Brian FitzpatrickIdentified as the person behind the BreachForums administrator alias Pompompurin; the article says he was arrested, pleaded guilty to hacking and child pornography possession, and was sentenced to supervised release.Diogo Santos CoelhoIdentified as the person behind the RaidForums administrator alias Omnipotent; the article says he was arrested and charged in connection with the site.
Threat Actors
BaphometBreachForums administrator who controlled forum-related domains and Telegram channels; the article says the FBI announced control of associated channels and reports that an arrest remained unconfirmed.OmnipotentAdministrator of RaidForums, a forum used to trade stolen data; the article identifies him as Diogo Santos Coelho.PompompurinCreated and operated a BreachForums predecessor used to trade stolen data; the article identifies him as Connor Brian Fitzpatrick.ShinyHuntersGroup reported to have partnered with Baphomet and to sell stolen data; members announced the relaunched BreachForums site.UsDoDThreat actor who posted on the seized BreachForums and announced plans to launch a separate site called Breach Nation.
Products
Breach NationWell known threat actor USDoD, who often posted on the now seized BF, announced via Twitter that he would be launching his own site called Breach Nation to be launched in early July.BreachForumsAs we reported last week, the popular data sharing dark web forum, BreachForums was seized by Law Enforcement.DoxbinThere was also speculation about a site called Doxbin which seemed to go down at the same time, although operators are claiming to still have control of the domain.RaidForumsFigure 2: RaidForums Seizure Notice TelegramAt the time of writing one of the clearnet mirrors was still up and pointing to a new Telegram channel promising to be back soon.