International Operation Dismantles Cracked and Nulled Cybercrime Hubs

A major law enforcement operation has taken down two of the world’s largest cybercrime forums, Cracked and Nulled.

The global operation was led by German authorities and supported by eight countries, including the US, France and Australia, as well as Europol. It took place from 28-30 January, 2025.

The action, named Operation Talent, enabled authorities to seize critical infrastructure used by the forums, including 17 servers, 12 domains and 50 electronic devices.

The seized servers have also provided law enforcement with information on the approximately 10 million users of Cracked and Nulled. This includes users’ email addresses, IP addresses and communication histories, which will provide a basis for further investigations.

Visitors to each of the websites are now greeted with an Operation Talent banner.

Other associated services taken down included a financial processor named Sellix, which was used by Cracked, and a hosting service called StarkRDP, which was promoted on both platforms.

Additionally, two individuals suspected of involvement in running the sites were arrested and seven properties searched.

Germany’s central criminal investigation agency (Bundeskriminalamt) said the suspects are German citizens aged 29 and 32.

Investigators estimate that the suspects earned €1m ($1.04m) in criminal profits.

A total of eight people have been identified who are believed to have been directly involved in the operation of the criminal trading platforms, including the two arrested suspects.

Approximately €300,000 ($312,369) in cash and cryptocurrencies were also seized by law enforcement in the action.

Cracked.io made an announcement on its Telegram channel regarding the takedown on January 29 at 20.13 GMT, telling its subscribers: “Cracked.io has been seized under operation talent with specific reasons being undisclosed. We are still waiting for the official court documentation from the data centre and the domain host. We will inform you guys further on those details once we have it.”

Cybercrime Marketplaces Fuel Cybercrime-as-a-Service

Cracked.io and Nulled.io have been major contributors to the growing cybercrime-as-a-service ecosystem, providing a platform to sell cybercriminal tools and services. This ecosystem enables less technically skilled individuals to carry out cyber-attacks.

These services included AI-based tools and scripts to automatically scan for security vulnerabilities and optimize attacks.

Europol noted that these platforms also often shared security vulnerabilities and provided tutorials on cybercriminal activities, such as malware creation and advanced phishing techniques.   

The agency commented: “Both of these underground economy forums offered a quick entry point into the cybercrime scene. These sites worked as one-stop shops and were used not only for discussions on cybercrime but also as marketplaces for illegal goods and cybercrime-as-a-service, such as stolen data, malware or hacking tools.”

The US Department of Justice estimated that the Cracked forum alone generated approximately $4m in revenue and impacted at least 17 million victims from the US. Nulled is estimated to have generated approximately $1m in yearly revenue. 

The operation follows German police successfully shutting down the country’s largest illegal dark web marketplace, Crimenetwork, in December 2024.