{"id":15249,"date":"2019-05-03T10:17:05","date_gmt":"2019-05-03T18:17:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/05\/03\/news-8998\/"},"modified":"2019-05-03T10:17:05","modified_gmt":"2019-05-03T18:17:05","slug":"news-8998","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/05\/03\/news-8998\/","title":{"rendered":"Feds Bust Up Dark Web Hub Wall Street Market"},"content":{"rendered":"<p><strong>Credit to Author: BrianKrebs| Date: Fri, 03 May 2019 16:48:36 +0000<\/strong><\/p>\n<p>Federal investigators in the United States, Germany and the Netherlands announced today the arrest and charging of three German nationals and a Brazilian man as the alleged masterminds behind the\u00a0<strong>Wall Street Market<\/strong> (WSM), one of the world&#8217;s largest dark web bazaars that allowed vendors to sell illegal drugs, counterfeit goods and malware. Now, at least one former WSM administrator is reportedly trying to extort money from WSM vendors and buyers (supposedly including Yours Truly) &#8212; in exchange for not publishing details of the transactions.<\/p>\n<div id=\"attachment_47615\" style=\"width: 603px\" class=\"wp-caption aligncenter\"><a class=\"lightbox\" href=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/wallstmkt.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-47615\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/wallstmkt.jpg\" alt=\"\" width=\"593\" height=\"317\" \/><\/a><\/p>\n<p class=\"wp-caption-text\">The now-defunct Wall Street Market (WSM). Image: Dark Web Reviews.<\/p>\n<\/div>\n<p>A complaint filed Wednesday in Los Angeles alleges that the three defendants, who currently are in custody in Germany, were the administrators of WSM, a sophisticated online marketplace available in six languages that allowed approximately 5,400 vendors to sell illegal goods to about 1.15 million customers around the world.<\/p>\n<p>&#8220;Like other dark web marketplaces previously shut down by authorities \u2013 Silk Road and AlphaBay, for example \u2013 WSM functioned like a conventional e-commerce website, but it was a hidden service located beyond the reach of traditional internet browsers, accessible only through the use of networks designed to conceal user identities, such as the Tor network,&#8221; reads a Justice Department release issued Friday morning.<\/p>\n<p>The complaint alleges that for nearly three years, WSM was operated on the dark web by three men who engineered an \u201cexit scam\u201d last month, absconding with all of the virtual currency held in marketplace escrow and user accounts. Prosecutors say they believe approximately $11 million worth of virtual currencies was then diverted into the three men&#8217;s own accounts.<\/p>\n<p>The defendants charged in the United States and arrested Germany on April 23 and 24 include 23-year-old resident of Kleve, Germany; a 31-year-old resident of Wurzburg, Germany; and a 29-year-old resident of Stuttgart, Germany. The complaint charges the men with two felony counts \u2013 conspiracy to launder monetary instruments, and distribution and conspiracy to distribute controlled substances. These three defendants also face charges in Germany.<\/p>\n<p>Signs of the dark market seizure first appeared Thursday when WSM&#8217;s site was replaced by a banner saying it had been seized by the German Federal Criminal Police Office (BKA).<\/p>\n<div id=\"attachment_47625\" style=\"width: 604px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-47625\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/wsm-sieze.jpg\" alt=\"\" width=\"594\" height=\"367\" \/><\/p>\n<p class=\"wp-caption-text\">The seizure message that replaced the homepage of the Wall Street Market on on May 2.<\/p>\n<\/div>\n<p>Writing for <a href=\"https:\/\/www.zdnet.com\/article\/law-enforcement-seizes-dark-web-market-after-moderator-leaks-backend-credentials\/\" target=\"_blank\" rel=\"noopener\">ZDNet&#8217;s Zero Day blog<\/a>, <strong>Catalin Cimpanu<\/strong> noted that &#8220;in this midst of all of this, one of the site&#8217;s moderators &#8211;named <strong>Med3l1n<\/strong>&#8212;\u00a0<a href=\"https:\/\/twitter.com\/5auth\/status\/1119710378504728578\" target=\"_blank\" rel=\"noopener noreferrer\" data-ss1556894557=\"1\">began blackmailing<\/a>\u00a0WSM vendors and buyers, asking for 0.05 Bitcoin (~$280), and <a href=\"https:\/\/twitter.com\/Patrick_Shortis\/status\/1120843564290904064\" target=\"_blank\" rel=\"noopener\">threatening<\/a> to disclose to law enforcement the details of WSM vendors and buyers who made the mistake of sharing various details in support requests in an unencrypted form.<\/p>\n<p>In a direct message sent to <a href=\"https:\/\/www.twitter.com\/briankrebs\" target=\"_blank\" rel=\"noopener\">my Twitter account<\/a> this morning, a Twitter user named <a href=\"https:\/\/twitter.com\/feruccifrances\" target=\"_blank\" rel=\"noopener\">@FerucciFrances<\/a> who claimed to be part of the exit scam demanded 0.05 bitcoin (~$286) to keep quiet about a transaction or transactions allegedly made in my name on the dark web market.<span id=\"more-47609\"><\/span><\/p>\n<p>&#8220;Make it public and things gonna be worse,&#8221; the message warned. &#8220;Investigations goes further once the whole site was crawled and saved and if you pay, include the order id on the dispute message so you can be removed. You know what I am talking about krebs.&#8221;<\/p>\n<div id=\"attachment_47612\" style=\"width: 608px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-47612\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/wsm-extort.jpg\" alt=\"\" width=\"598\" height=\"394\" \/><\/p>\n<p class=\"wp-caption-text\">A direct message from someone trying to extort money from me.<\/p>\n<\/div>\n<p>I did have at least one user account on WSM, although I don&#8217;t recall ever communicating on the forum with any other users, and I certainly never purchased or sold anything there. Like most other accounts on dark web shops and forums, it was created merely for lurking. I asked @FerucciFrances to supply more evidence of my alleged wrongdoing, but he has not yet responded.<\/p>\n<p>The Justice Department said the MED3LIN moniker belongs to a fourth defendant linked to Wall Street Market &#8212; <strong>Marcos Paulo De Oliveira-Annibale<\/strong>, 29, of Sao Paulo, Brazil &#8212; who was charged Thursday in a criminal complaint filed in the U.S. District Court in Sacramento, California.<\/p>\n<p>Oliviera-Annibale also faces federal drug distribution and money laundering charges for allegedly acting as a moderator on WSM, who, according to the charges, mediated disputes between vendors and their customers, and acted as a public relations representative for WSM by promoting it on various sites.<\/p>\n<p>Prosecutors say they connected MED3LIN to his offline identity thanks to photos and other clues he left behind online years ago, suggesting once again that many alleged cybercriminals are not terribly good at <a href=\"https:\/\/krebsonsecurity.com\/category\/breadcrumbs\/\" target=\"_blank\" rel=\"noopener\">airgapping their online and offline selves<\/a>.<\/p>\n<p>&#8220;We are on the hunt for even the tiniest of breadcrumbs to identify criminals on the dark web,&#8221; said <strong>McGregor W. Scott<\/strong>, United States Attorney for the Eastern District of California. \u201cThe prosecution of these defendants shows that even the smallest mistake will allow us to figure out a cybercriminal&#8217;s true identity. As with defendant Marcos Annibale, forum posts and pictures of him online from years ago allowed us to connect the dots between him and his online persona \u2018Med3l1n.\u2019 No matter where they live, we will investigative and prosecute criminals who create, maintain, and promote dark web marketplaces to sell illegal drugs and other contraband.&#8221;<\/p>\n<p>A copy of the Justice Department&#8217;s criminal complaint in the case is <a href=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/Wall-Street-Market-adminstrator-COMPLAINT.pdf\" target=\"_blank\" rel=\"noopener\">here<\/a> (PDF).<\/p>\n<p><a href=\"https:\/\/krebsonsecurity.com\/2019\/05\/feds-bust-up-dark-web-hub-wall-street-market\/\" target=\"bwo\" >https:\/\/krebsonsecurity.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2019\/05\/wallstmkt.jpg\"\/><\/p>\n<p><strong>Credit to Author: BrianKrebs| Date: Fri, 03 May 2019 16:48:36 +0000<\/strong><\/p>\n<p>Federal investigators in the United States, Germany and the Netherlands announced today the arrest and charging of three German nationals and a Brazilian man as the alleged masterminds behind the\u00a0Wall Street Market (WSM), one of the world&#8217;s largest dark web bazaars that allowed vendors to sell illegal drugs, counterfeit goods and malware. Now, at least one former WSM administrator is reportedly trying to extort money from WSM vendors and buyers (supposedly including Yours Truly) &#8212; in exchange for not publishing details of the transactions.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10642],"tags":[21733,10615,21734,21735,16696,17061,21736,17006],"class_list":["post-15249","post","type-post","status-publish","format-standard","hentry","category-independent","category-krebs","tag-feruccifrances","tag-dark-web","tag-mcgregor-w-scott","tag-med3lin","tag-neer-do-well-news","tag-the-coming-storm","tag-wall-street-market","tag-web-fraud-2-0"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/15249","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=15249"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/15249\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=15249"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=15249"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=15249"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}