Somewhere in the woods outside of Traben-trarbach in Germany is a Cold War bunker hidden from
public sight. It's over five stories deep, with concrete walls nearly three feet wide.
The bunker was meant to withstand a nuclear attack on the eve of full-scale war against
the Soviet Union, and allow NATO to continue front-line operations against the Red army.
It became the hub of a vast criminal dark web empire
which would be home to what was called the Amazon of criminality.
250,000 crimes. That's the official tally by police for the number of crimes that the group
running a massive underground cyberbunker operation were either responsible for,
or aided in perpetrating. At their trial, the eight defendants had to stand for two hours
just for the judge to read through all of their charges. The four dutch,
three germans, and one bulgarian cyber criminals are charged with aiding and
abetting criminals in crimes involving drugs, contract killings, money laundering and more.
The group got its start when in 2013, the group's leader Johan- last name withheld-
bought the former NATO complex from the German government. Originally meant to house a NATO
command center, the bunker was built deep underground in order to withstand frontline
nuclear weapons employed by the Soviet Union in case of full-scale war. This bunker, and a series
of others, would have allowed NATO to maintain command and control in a nuclear battlefield.
The local townsfolk were wary of the new owners of the bunker,
and the mayor contacted Johan asking if he would be allowed to visit.
Johan was extremely open and offered to give the mayor free access as he wished,
he only needed a little bit of warning because of quote- guard dogs. The mayor took him up on that
offer and visited the bunker on several occasions, even being allowed access to any locked door he
wished. What he found was a slowly growing data center full of computer equipment, but absolutely
no sign of the millions of dollars of criminal activity that data center was facilitating.
Johan had promised that he would build just such a data center, eventually offering up to 80 jobs
to the local community. He even promised he'd build an IT training center for free for the town,
but even after being questioned, he always remained vague about what exactly his
operation was all about. Who's data was being processed by the growing rows of computer banks?
Where did it come from? What sort of business was Johan supporting?
As the years went by not only did the local townsfolk not get an answer,
but Johan's promises about jobs and a training center failed to materialize.
The townsfolk then began to stir up rumors that Johan was actually either buying or producing
drugs, or selling weapons from the bunker. However, the mayor's visits showed no signs
of any such activity. Resigning themselves to the strange, new business start up in their vicinity,
the local townsfolk quickly put it out of their minds. They had no way of knowing that an
entire planet's worth of crime was being directly supported from their sleepy little
town. Everything from massive drug sales and purchases to hit jobs and corporate extortion.
It woulnd't be until September 2019 that the residents of Traben-Trarbach
would realize that a monster had been lurking in their midst,
as they awoke to the sound of dozens of police sirens and helicopters buzzing over head.
But just what had been going on at the now-termed Cyberbunker?
The massive underground server farm had actually served as a “bulletproof hosting” service-
in and of itself not illegal. Bulletproof hosting is a service that allows a customer
to host almost whatever kind of material that they want to on the host's servers,
a natural attraction for those seeking to use the internet for illegitimate reasons. In the case of
Cyberbunker, the rules were simple: you could host anything you wanted as long as it didn't involve
terrorism. This proved extremely attractive for criminal connoisseurs working off the dark web.
In theory, anyone could subscribe to a bulletproof host- but the fact that these
servers are typically located overseas from a customer and don't worry themselves with terms
of use or reports of abuse, naturally attracts those who wish to keep their online activity
as secret as possible. Usually cybercriminals and spammers are drawn to these types of online hosts,
as they know that the host will not be concerned with abuse reports and has no code of conduct or
similar limitation on what an individual may or may not use the server for. These hosting
services typically go so far as to even resist court orders entirely, only relenting when
police physically raid their location to enforce compliance. By then, it's likely that much of a
customer's data will have been purged, granting additional protection to the subscriber. That's
why in the case of Cyberbunker, police had to act swiftly and without alerting Johan or his team.
Rather than compromising their client's privacy though, most of these hosts run until
they physically shut down to avoid authorities, popping up again later in a different location.
Most of these hosts operate out of China, where government oversight of this sort of thing is lax.
In fact, the Chinese government engages in so much cyberspying that it's believed to
actually cooperate with a segment of the cybercriminal element in its own borders,
and countries wishing to investigate bulletproof hosts inside of China's borders have their
requests largely ignored. However, southeast Asia, Russia, and surrounding countries are also popular
choices for bulletproof hosts- though McColo, which was responsible for an astonishing 2/3rd's
of the world's spam when it was shut down, was hosted right here in the United States.
The one weakness of a bulletproof host is that they are still under the thumb of upstream
providers which link them to the internet. Thus if a server is believed to be bulletproof,
pressure can be put on the upstream provider to shut the server down.
Cyberbunker was set up to allow its users to host websites on the darkweb, and claimed that
it didn't know what activity was taking place on its servers- its customer's business was its own.
Linking a host with the criminal activity that may or may not be taking place on its servers
can be difficult, and police have to carefully show that the team behind Cyberbunker knew
exactly what was going on. Regular servers can also be used to conduct illegal activity,
and often this happens right under the legitimate host's nose- but Cyberbunker was specifically
kitted out to cater to cybercriminals, despite what their defense attorney may say.
Cyberbunker's bust led to immediate success for police, with the bust directly leading to the
shutdown of what came to be known as the 'ebay for criminals', and the arrest of its owner.
Darkmarket as it was known basically allowed a customer to shop for anything illegal that they
could wish for, with all the ease and convenience of a legitimate marketplace such as Amazon.
Sellers there could provide everything from drugs, to counterfeit money,
stolen or forged credit cards, anonymous sim cards, and all sorts of malware. Transactions
would take place with bitcoin, helping to mask the identity of seller and buyer, and goods
could be delivered in a variety of fashions. Digital items could be directly downloaded
after a transaction cleared, while physical goods would simply be mailed wherever the buyer wanted.
Some street hustlers actually began to get their supply off Darkmarket rather than deal
with traditional, and dangerous street gangs. The site allowed sellers the convenience of a one-stop
shopping experience, free of any possibility for violence, and with goods shipped directly
to wherever the buyer wanted. Typically in order to further mask their operation,
a street pusher would buy their drugs online, have them shipped to an air bnb
location, and then have an unwitting third party deliver them to a drop-off point,
typically by asking them to “do a favor” in exchange for cheaper rent, etc.
Sellers on Darkmarket would also be rated by customers and have the
number of transactions publicly listed, no different than a normal online marketplace.
This helped to ensure that sellers didn't rip off buyers, and establish their credibility.
Given the dangerous nature of buying and selling drugs or other illegal items on the streets,
both vendors and buyers greatly preferred using Darkmarket or other darkweb marketplaces,
and the anonymity of bitcoin made tracing their transactions extremely difficult. In all,
over 320,000 transactions occurred on Darkmarket, worth a total of 4,650 bitcoin or $221 million.
As soon as Cyberbunker was busted by authorities,
Darkmarket migrated its operation to new servers in Ukraine and Moldova,
but authorities were able to shut those down as well. Inevitably the man behind Darkmarket
was caught, an Australian man known as Julian K. The extent of criminality involved at the
Cyberbunker facility is so vast that a full year on many details are still unknown by the public.
What is known is that Cyberbunker had been in operation long before the NATO bunker in Germany.
In fact, before expanding to Germany, Cyberbunker operated servers out of a NATO bunker in South
Holland, and had a history of criminality well before the public bust in 2019. It was eventually
identified as the web host for the infamous The Pirate Bay, one of the most notorious websites for
sharing everything from movies to music to books. If it can be digitized, The Pirate Bay hosted it,
and made it available for download for free, costing the software, movie, music,
and other segments of the entertainment industry untold millions in losses. The website has been
shutdown multiple times but always reappears, and today it is still the premier destination
for torrents of all sorts- along with a heaping helping of viruses that come along with them.
In 2010, a court ruled that Cyberbunker was no longer allowed to host The Pirate Bay,
or face stiff fines and up to 2 years imprisonment for each infringement of the court order.
The next year, Spamhaus, a project aimed at detecting, identifying,
and shutting down distributors of spam, identified Cyberbunker as the host for many spammers. They
contacted their upstream provider, A2B, asking them to cancel their service to Cyberbunker,
but A2B refused- choosing instead to block only a single IP address related to spamming
hosted by Cyberbunker. Spamhaus then blacklisted A2B, informing them that as long as they hosted
Cyberbunker they would remain blacklisted, forcing A2B to eventually drop Cyberbunker as a client.
In 2013 Spamhaus blacklisted Cyberbunker, resulting in an almost immediate distributed
denial of service attack against Spamhaus. This attack became one of the largest in cybercrime
history, and dragged in five different national cyber-police forces into its investigation.
The attack lasted for over a week, but with the help of Google, Spamhaus was able to weather the
attack. Eventually the attack was tracked down to criminal gangs from Eastern Europe and Russia,
believed to be operating in conjunction with Cyberbunker-
though the attack could never be linked directly to Cyberbunker itself, giving them plausible
deniability. Shortly after the attack though, Cyberbunker was believed to itself be attacked,
knocking the host offline for a full day and costing them significant revenue.
On April 25th, 2013, Sven Olaf Kamphuis, a spokesperson for Cyberbunker, was arrested
by Spanish authorities outside of Barcelona. An anonymous press release released on pastebin.com
warned that if Kamphuis was not released, there would be more large-scale cyberattacks
for every day he remained in custody. Kamphuis remained in custody for 55 days before being
extradited to the Netherlands, where he was found guilty and sentenced to 240 day in prison. His
sentence however was suspended, and he was given credit for the 55 days already served in Spain.
It may have taken over a decade, but authorities eventually nailed Cyberbunker to the wall,
so to speak, and shut down the entire operation. The criminal trial is still ongoing,
but at least one defendant has been set free after a partial confession and serving 22
months in pre-trial detention. The rest of the defendants will have to face their day in court,
and despite claims of ignorance on their behalf, authorities have enough evidence to link them to
the incredible amount of crime facilitated by their two bunkers in the European countryside.
For the criminals who used Cyberbunker's servers, while there have already been some arrests,
others are believed to be pending. Given the intelligence goldmine that Cyberbunker's seizure
by authorities has been, it's believed that ongoing investigations and stings will evolve over
the coming years. How many criminals will come to trial however remains unknown, and for now,
illegal activities on the darkweb have simply shifted to fresh servers located elsewhere.
Now check out why you should never access the dark web, or click this other video instead!