The New DarkWeb Forum: ExposedVC Forums

Executive Summary

Ever since Pompompurin’s arrest and the shutdown of BreachedForums, threat actors have been looking for a new home to migrate and continue their cybercrime activities, especially the data leakage groups.

Although Telegram has become one of the most popular platforms for the cybersecurity community, data leakage groups and other cybercrime sellers still need an underground forum to advertise their services and findings.

The Cyberint Research Team has discovered a new forum that claims to be the successor of the notorious BreachedForums.

ExposedVC Forum

The new forum, dubbed ExposedVC, is an underground leak site based on the BreachedForums structure (Figure 1).

Like Genesis Market, BreachedForums, and RaidForums before, ExposedVC forum also provides an anonymous underground forum where threat actors can advertise and leak stolen data. There are many hacking services and new malwares for sale.

The forum itself is managed by a user named Impotent. He announced new features and policies for the forum, which already has around 2000 users in under two weeks of operation (see Figure 2).

Eliminating Competition

In addition, another founder of the forum, Purism, has announced war on other underground forums. He has promised to expose and leak the information of their infrastructure and backend servers (see Figure 3). Purism has already compromised the information of several underground forums, such as BlackForums (see Figure 4).

Impotent has already initiated a poll on their Telegram channel, asking who should be the next forum they expose (see Figure 5).

Telegram Advertising Campaign

In the past several days, ExposedVC admins pushed the forum in various Telegram channels and created their own Telegram channel and chat group (Figure 6).

It seems that the forum admins are looking to establish a new and solid replacement for BreachedForums.

ExposedVC’s Relations to Other Forums

Monitoring the forum’s trackers and unique IDs, some trackers were found identical to the other forums, such as PwnedForums, which closed shortly after it was opened, and CrackersBay, which was first seen in 2021.

Community’s Adoption

The ExposedVC forum looks like BreachedForums, which makes it more convenient for users who are used to BreachedForums. However, the community tends to be more suspicious of new forums, given their experience with PwnedForums, which is still suspected to be a honeypot of the FBI.

While some have already joined the forum, others claim this is another scam by the authorities to mark new targets.

Cyberint and the Dark Web

Cyberint excels in accessing high-tier sources that remain elusive to most companies. Our unique ability to penetrate these hidden corners enables us to collect and analyze invaluable data. We enrich our automated collection with a human approach, through research and analysis of our military-grade expert team.

Find new sources in deep and dark web marketplaces, forums, and sites, even if those sources are volatile and difficult to track. Get deep analysis and reports, that allow you to understand a specific threat actor and group profiling, including the places of operation, targeted countries or verticals, TTPs and more. Get a demo and see what assets you have exposed on the deep & dark web.