- Browse/Search the Program
Search
Program Calendar
Browse By Day
Browse By Room
- Information Menu
Search Tips
Virtual Exhibit Hall
- Navigation and Settings Menu
Personal Schedule
Sign In
The ripple effect of Operation Cookie Monster: How did a dark market takedown impact an untargeted hacker forum?
Fri, September 5, 8:00 to 9:15am, Deree | Auditorium, Floor: 6, 6th Level AuditoriumAbstract
On April 4, 2023, Operation Cookie Monster (OCM), a coordinated global law enforcement operation, dismantled Genesis Market, a major platform for selling stolen account credentials. The operation seized the market’s surface-web servers and targeted its users, leading to over 400 law enforcement actions across 16 countries, including arrests, searches, and official warnings. While the immediate impact on Genesis Market is clear, the broader ripple effects on the hacking ecosystem remain underexplored. Some prior interventions suggest crime displacement, where offenders shift their illegal activities to adapt, while law enforcement operators argue that OCM also led to diffusion of benefits, extending its impact beyond the targeted market servers. Two years later, neither the surface web nor the untargeted deep-web version of Genesis Market has resurfaced.
Beyond dedicated marketplaces, hacker forums play a crucial role in the cybercrime ecosystem, often overlapping in user base with illicit markets. These forums facilitate both licit and illicit hacking-related discussions, including the trade of stolen credentials, making them a key site to study indirect effects of interventions like OCM. This study investigates how OCM influenced activity on an untargeted hacker forum, focusing on posts advertising stolen account credentials. Specifically, we examine changes in post frequency, content, and the rank of post authors as a proxy for reputation. By comparing trends from three months before to six months after OCM, we assess whether any initial disruptions persist over time or if the forum returns to its prior state.