Police Seizes Cracked and Nulled Hacking Forum Servers, Arrests Suspects

In a coordinated international operation, Europol and German law enforcement confirmed the arrest of two individuals and the seizure of 17 servers from two notorious hacking forums: Cracked and Nulled. These forums, known for hosting millions of cybercriminals and hackers, were taken down as part of Operation Talent, a joint law enforcement effort aimed at disrupting the underground cybercrime economy.

The Rise and Fall of Cracked and Nulled

Cracked and Nulled were two of the largest hacking forums on the internet, amassing over 10 million users collectively. Despite some of their members engaging in ethical hacking discussions, these platforms were infamous for their focus on illegal activities. The forums were widely regarded as hotbeds for cybercrime, with topics ranging from password theft to cracking and credential-stuffing attacks.

These forums were also a marketplace for hacking tools, including AI-based tools and scripts designed to scan for security vulnerabilities, optimize attacks, and facilitate illegal activities. Cracked and Nulled hosted a variety of “configs” used for credential-stuffing attacks, tools such as OpenBullet and SilverBullet, and illicit content related to software cracks. Additionally, both forums offered a “combo list” marketplace, where stolen credentials and databases could be bought and sold.

The U.S. Justice Department revealed that Cracked had over 4 million users and was responsible for around 28 million ads promoting cybercrime tools. The forum generated an estimated $4 million in revenue and impacted approximately 17 million victims across the U.S. Meanwhile, Nulled boasted over 5 million users and 43 million ads for hacking tools, generating roughly $1 million in annual revenue.

Both forums served as gateways into the world of cybercrime, acting as one-stop shops for anyone looking to engage in illegal activities. These platforms enabled cybercriminals to not only discuss criminal techniques but also gain access to stolen data, malware, and other hacking tools. Moreover, the forums facilitated cybercrime-as-a-service, offering malicious tools and services for a fee.

The Seizure and Arrests

As part of Operation Talent, law enforcement agencies from multiple countries, including the U.S., Italy, Spain, France, Greece, Australia, and Romania, collaborated to dismantle these illegal operations. On January 30, 2025, Europol confirmed the arrests of two individuals linked to Cracked and Nulled, with additional property searches and the seizure of over 50 electronic devices and €300,000 in cash and cryptocurrency.

A total of 12 domains associated with the two platforms were seized, including cracked[.]io, nulled[.]to, starkrdp[.]io, mysellix[.]io, and sellix[.]io. Authorities also took down StarkRDP, a Windows RDP virtual hosting provider promoted on both forums, and Sellix, a financial processor used by Cracked.

The FBI played a key role in the operation by seizing the domains of Cracked and Nulled. The FBI redirected the name servers of the hacked forums to ns1.fbi.seized.gov and ns2.fbi.seized.gov. This served as a clear signal to users that the forums had been taken down by international law enforcement.

Cracked’s staff, in a Telegram post, confirmed the seizure of their domain, cracked[.]io, but stated they were waiting for official court documentation from the data center and domain host. The message expressed disappointment and frustration, with the staff acknowledging the significant blow to their community.

The Financial Impact and Wider Reach

The operation’s success highlights the global scale of cybercrime and its far-reaching impact on digital security. The forums were not just hubs for hackers but also for cybercriminal economies. Both Cracked and Nulled were integral parts of a larger, interconnected network of illegal services. For instance, Sellix was a financial processor that enabled Cracked members to pay for malicious tools and services, while StarkRDP was used to host virtual machines for hacking purposes.

German law enforcement emphasized that the seizures also targeted these associated services because they were directly tied to the financial ecosystem supporting the cybercrime platforms. By shutting down these services, authorities have effectively disrupted the operation of the hacking forums and hindered their ability to generate revenue.

In addition to the arrests and server seizures, law enforcement also obtained a wealth of data from the seized devices, including email addresses, IP addresses, and other communication channels. This information will be crucial for further investigations targeting criminal sellers and users who were active on the platforms.

Charges and Legal Consequences

As of January 30, 2025, the Spanish National Police arrested two suspects linked to the seizure of Cracked and Nulled. One of the individuals arrested is reportedly Lucas Sohn, a 28-year-old administrator of Nulled. Sohn was responsible for performing escrow functions on the website, which involved holding payments for cybercriminals until services were delivered.

If convicted, Sohn faces serious charges, including conspiracy to traffic in passwords, access device fraud, and identity fraud. The U.S. Justice Department has outlined potential penalties for these charges, which could result in a prison sentence of up to 30 years.

In a broader context, the operation also underscores the growing international collaboration between law enforcement agencies to combat cybercrime. With cybercriminal activities becoming more sophisticated, international cooperation is crucial in addressing the threats posed by these forums, which offer a gateway to the darker side of the internet.

Looking Ahead

The crackdown on Cracked and Nulled represents a significant victory in the fight against cybercrime. However, as law enforcement continues to target the underground economy, it is likely that new forums and platforms will emerge to replace those that have been taken down. The success of Operation Talent sets a precedent for future operations and highlights the importance of global cooperation in tackling cybercrime.

Authorities have sent a clear message to cybercriminals that the law enforcement community is vigilant and capable of dismantling even the largest and most well-established criminal networks on the dark web. The hope is that, with continued efforts, the underground economy that fuels cybercrime can be significantly disrupted, making it harder for these illicit operations to thrive.