Hello, World!
The internet’s largest English speaking cyber crime forum, Breachforums is back.
It was shutdown just 3 months ago after its notorious owner Pompompurin was arrested by
the FBI.
But is the new Breachforums really “back with the original team” as it claims, or
could it be some kind of honeypot, created by the FBI?
The original breachforums launched in March 2022, run by Pompompurin - a well known hacker
and master troll who branded himself using a hellokitty character.
The site was incredibly successful, it gained a quarter of a million users and became the
place for cyber criminals to sell hacked databases - the FBI claims Breachforums was home to
datasets “consisting of over 14 billion individual records”, that’s almost 2 records
per person on Earth.
For a good while if there was news of a data breach, you could bet it was being sold right
here on breachforums.
But breachforums didn’t last long, barely a week after its first birthday, its owner
Conor Brian Fitzpatrick AKA Pompompurin was arrested by the FBI.
Which was only made possible thanks to a handful of really dumb opsec mistakes he made - I
have a whole video on that, which I’ll make sure to link down in the description.
However breachforums itself was never seized by the FBI, the feds never got the chance
to redecorate the home page with one of their famous seizure banners.
Instead, the site was now in the hands of its second in command, an Admin going by Baphomet
- he vowed to keep Breachforums alive and migrate to new infrastructure.
But those hopes ended when he announced he was shutting down breachforums for good.
It was just too risky to reboot the site when it became clear that the FBI had access to
Pompompurin’s computer, Baphomet said “I now feel like I'm put into a position where
nothing can be assumed safe, whether its our configs, source code, or information about
our users - the list is endless”.
And so breachforums died, leaving a gap in the market for another forum to take its place,
but none ever did.
However all that changed in the last couple days when there was a surprise announcement
on Baphomet’s personal site, a PGP signed message saying that Breachforums was back.
He links a new domain, and on the surface it seems to be business as usual - many breachforums
1.0 users have returned, and even the famous leaks market instantly became active.
Though of course, don’t expect to find Pompompurin here, I believe he’s on bail with the court
proceedings against him still yet to get underway.
Instead the new forum’s owner is a user going by “Shinyhunters”.
Now, if you’ve been watching this channel for a while you’ll know there’s an infamous
cyber criminal group which goes by the same name, and it’s being reported that this
isn’t a coincidence, but that the new version of Breachforums is being run by the ‘ShinyHunters’
hacking group.
This group spawned in 2020 during lockdown and made their name by leaking databases,
a lot of them.
One of their most notable breaches targeted Microsoft’s own github account, which resulted
in ShinyHunters leaking gigabytes of their source code.
These guys are notorious, they’re one of the few cyber criminal gangs to have their
own wikipedia page, and I suppose they are a natural partner for a forum which specialises
in data breaches.
I mean - Baphomet did say in his closing remarks that he was having “conversations with some
of the competitor forum admins and various service operators who reached out to [him].”
And that he was “hoping to work with some of those people to build a new community”,
I guess, ShinyHunters seems to be who he settled on.
However it’s impossible to say if the real shinyhunters group is behind this account,
some forum members are dubious - it isn’t unheard of for cyber miscreants do sometimes
hijack the brands of others.
The official ShinyHunters twitter account hasn’t confirmed anything, I mean - the
account is pretty much dead, and ShinyHunters haven’t been in the news for a while, I
couldn’t find much evidence of them being active past 2021.
In fact one of their alleged members, a French student, was arrested in July last year, he’s
currently facing extradition to the US.
When rumours arose earlier this month that Breachforums would return under new management,
a lot of people were sussed out.
The old breachforums domain still carries the message “Any forums claiming to be "Breached"
or "BreachForums" should be used with caution.
BreachForums will never return.”
As such some users are questioning whether this new site is really just an FBI controlled
honeypot.
The best evidence that it isn’t is that PGP signed message from breachforums’ original
admin Baphomet, but this doesn’t rule out the idea that Baphomet was somehow compromised…
or more likely than him being compromised, perhaps PGP key was sold to someone wanting
to reboot the site.
But of course this is all blind speculation.
Also, some people are a little sussed out by the fact that Baphomet hasn’t posted
anything yet on the forum despite it being over 2 whole days since the site was rebooted.
What’s really going on?
Who knows, but hopefully I’ve done a decent job of laying out the facts, though if there’s
something I’ve missed do let me know down below.
And of course I’d be interested to hear your thoughts in the comments on this one.
If you want to be notified as soon as we hear more on breachforums, make sure to subscribe
and hit the bell icon, and I’ll see you in the next video, have a good one.