Executive Summary
Ever since Pompompurin’s arrest and the shutdown of BreachedForums, threat actors have been looking for a new home to migrate and continue their cybercrime activities, especially the data leakage groups.
Although Telegram has become one of the most popular platforms for the cybersecurity community, data leakage groups and other cybercrime sellers still need an underground forum to advertise their services and findings.
The Cyberint Research Team has discovered a new forum that claims to be the successor of the notorious BreachedForums.
ExposedVC Forum
The new forum, dubbed ExposedVC, is an underground leak site based on the BreachedForums structure (Figure 1).
Like Genesis Market, BreachedForums, and RaidForums before, ExposedVC forum also provides an anonymous underground forum where threat actors can advertise and leak stolen data. There are many hacking services and new malwares for sale.
The forum itself is managed by a user named Impotent. He announced new features and policies for the forum, which already has around 2000 users in under two weeks of operation (see Figure 2).
Eliminating Competition
In addition, another founder of the forum, Purism, has announced war on other underground forums. He has promised to expose and leak the information of their infrastructure and backend servers (see Figure 3). Purism has already compromised the information of several underground forums, such as BlackForums (see Figure 4).
Impotent has already initiated a poll on their Telegram channel, asking who should be the next forum they expose (see Figure 5).
Telegram Advertising Campaign
In the past several days, ExposedVC admins pushed the forum in various Telegram channels and created their own Telegram channel and chat group (Figure 6).
It seems that the forum admins are looking to establish a new and solid replacement for BreachedForums.
ExposedVC’s Relations to Other Forums
Monitoring the forum’s trackers and unique IDs, some trackers were found identical to the other forums, such as PwnedForums, which closed shortly after it was opened, and CrackersBay, which was first seen in 2021.
Community’s Adoption
The ExposedVC forum looks like BreachedForums, which makes it more convenient for users who are used to BreachedForums. However, the community tends to be more suspicious of new forums, given their experience with PwnedForums, which is still suspected to be a honeypot of the FBI.
While some have already joined the forum, others claim this is another scam by the authorities to mark new targets.
Related Articles
