Admins of Genesis Market marketplace sold their infrastructure on a hacker forum

The admins of the darkweb Genesis Market announced the sale of their platform to a threat actor that will restart operations next month.

In April, the FBI seized the Genesis Market, a black marketplace for stolen credentials that was launched in 2017. Genesis Market was an invite-only marketplace, but it was not complex to find invite codes online.

One of the most interesting features offered by the platform is the access to “browser fingerprints” that allow crooks to impersonate victims’ web browsers, including IP addresses, operating system data, time zones, device info, session cookies, and more.

The price for a stolen account was very cheap, paying a few dollars crooks were able to use it for a specific period. Genesis Market provided access to accounts of the most popular services, including Amazon, eBay, Facebook, Gmail, Netflix, PayPal, Spotify, and Zoom.

The seizure is part of a law enforcement operation codenamed Operation Cookie Monster.

As reported by BleepingComputer, on June 28, the alleged admin of Genesis Market (GenesisStore) announced on a cybercrime forum that the platform was available for sale.

“A buyer been found and a deposit has been made. The store will handed over to a new owner next month. Accounts on the forums will not be transferred, the new owner will create new accounts if necessary.” reads the GenesisStore‘s announcement on the hacker forum.

Cybersecurity firm Flare learned that the sale included the overall infrastructure of “the store with all the developments” and its data, including clients’ details.

The data offered by the administrators included:

device fingerprints (e.g. cookies, IP addresses, time zones, device info) cookies the form grabber that collected all the data (custom JavaScript code) saved passwords other persona details from networked computers

On Thursday, GenesisStore revealed that the deal is going to be complete by “next month.”

BleepingComputer added that the admins would not hand over the accounts on the forum.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco)

---