Attending InfoSec?

The New DarkWeb Forum: ExposedVC Forums

The New DarkWeb Forum: ExposedVC Forums

Executive Summary

Ever since Pompompurin’s arrest and the shutdown of BreachedForums, threat actors have been looking for a new home to migrate and continue their cybercrime activities, especially the data leakage groups.

Although Telegram has become one of the most popular platforms for the cybersecurity community, data leakage groups and other cybercrime sellers still need an underground forum to advertise their services and findings.

The Cyberint Research Team has discovered a new forum that claims to be the successor of the notorious BreachedForums.

ExposedVC Forum

The new forum, dubbed ExposedVC, is an underground leak site based on the BreachedForums structure (Figure 1).

ExposedVC forum home screen
Figure 1: ExposedVC forum home screen

Like Genesis Market, BreachedForums, and RaidForums before, ExposedVC forum also provides an anonymous underground forum where threat actors can advertise and leak stolen data. There are many hacking services and new malwares for sale.

The forum itself is managed by a user named Impotent. He announced new features and policies for the forum, which already has around 2000 users in under two weeks of operation (see Figure 2).

One of Impotent’s announcements on the Exposed VC forum
Figure 2: One of Impotent’s announcements on the ExposedVC forum

Eliminating Competition

In addition, another founder of the forum, Purism, has announced war on other underground forums. He has promised to expose and leak the information of their infrastructure and backend servers (see Figure 3). Purism has already compromised the information of several underground forums, such as BlackForums (see Figure 4).

Purism’s announcement of war against the other forums
Figure 3: Purism’s announcement of war against the other forums
Exposing backend information of BlackForums on ExposedVC Forum
Figure 4: Exposing backend information of BlackForums

Impotent has already initiated a poll on their Telegram channel, asking who should be the next forum they expose (see Figure 5).

Figure 5: Impotent’s poll about which forum to expose next on their Telegram channel
Figure 5: Impotent’s poll about which forum to expose next on their Telegram channel

Telegram Advertising Campaign

In the past several days, ExposedVC admins pushed the forum in various Telegram channels and created their own Telegram channel and chat group (Figure 6).

ExposedVC Forum's Telegram channel promotion
Figure 6: ExposedVC Forum’s Telegram channel promotion

It seems that the forum admins are looking to establish a new and solid replacement for BreachedForums.

ExposedVC’s Relations to Other Forums

Monitoring the forum’s trackers and unique IDs, some trackers were found identical to the other forums, such as PwnedForums, which closed shortly after it was opened, and CrackersBay, which was first seen in 2021.

Community’s Adoption

The ExposedVC forum looks like BreachedForums, which makes it more convenient for users who are used to BreachedForums. However, the community tends to be more suspicious of new forums, given their experience with PwnedForums, which is still suspected to be a honeypot of the FBI.

While some have already joined the forum, others claim this is another scam by the authorities to mark new targets.

 

Book a Demo

Uncover your compromised credentials from the deep and dark web

Fill in your business email to start