The U.S. Department of Justice (DOJ) announced on Wednesday the Cryptocurrency Fund seizes and about 145 ClearNet and Dark web domains related to the illegal carding market known as Bidencash.
“Bidencash Marketplace operators use the platform to simplify the process of buying and selling stolen credit cards and related personal information,” DOJ said. “The Bidencash administrator has charged us a fee for all transactions conducted on the website.”
Bidencash was launched in March 2022 and filled the gap left by the Joker Stash closure and several other carding forums like Unicc a year ago.
Since it became operational, illegal bazaars (“Bidencash(.)Asia”, “Bidencash(.)BD” and “Bidencash(.)WS” are estimated to support over 117,000 customers, promoting trafficking and personally identifiable information on over 15 million payment carding numbers, generating more than $17 million in revenue.
Specifically, the platform has published 3.3 million individual stolen credit cards for free to promote use of the service between October 2022 and February 2023.
According to Flashpoint, of the 2.1 million infringed credit cards released in February 2023, 50% of the cards belonged to US-based people or organizations.
Bidencash also specializes in selling compromised credentials, allowing other criminals to purchase and gain access to their computers without permission.
In a report published in May 2023, CloudSek revealed that Bidencash has begun offering to promote SSH services to buyers for a low $2, $2.
“This poses a significant risk because it can leverage this power, as it can carry out a wide range of malicious activities such as data stripping, brute force, ransomware attacks, and cryptocurrency mining,” the cybersecurity company said at the time.
However, authorities did not disclose the value of the confiscated cryptocurrency fund or identify the Bidencash operator and its physical location.
According to the seizure flag, Bidenkash’s crackdown is part of an international effort led by the US Secret Service and the Federal Bureau of Investigation (FBI), in partnership with Dutch politics, the Shadowser Foundation and Searchlight Cyber.
The development comes days after the operation of multinational law enforcement confiscated the four domains that threaten counter-antivirus (CAV) and cryptographic services to prevent malicious software from being detected in security software.
It is also said that following the arrest of a 35-year-old Ukrainian citizen, it was split into more than 5,000 customer accounts by an unknown hosting company to illegally mine cryptocurrency on hacked servers. Nameless individuals face up to 15 years in prison.
The defendant is allegedly using open source intelligence to find and violate vulnerable infrastructures in various international organizations. The virtual machine is then deployed to perform fraudulent cryptojacking, resulting in $4.5 million in damages. The threat actor is believed to have been active since at least 2018.
