Genesis Market

Genesis Market was an English-language cybercrime-facilitation marketplace associated with the sale of stolen personal information, account credentials, and persistent access to compromised computers. It became particularly notable because its interface was designed to make identity-based fraud accessible to users with limited technical expertise. Rather than merely offering static collections of passwords, the marketplace provided what it described as digital profiles, or “bots,” containing information harvested from infected computers. These profiles could include usernames, passwords, browser cookies, device information, and other data useful for impersonating a victim or bypassing account-security controls. The marketplace reportedly launched in beta in 2017. Its material was collected through information-stealing malware installed on victims’ computers. The service was associated with credentials for widely used consumer and financial platforms, including Airbnb, Amazon, eBay, Facebook, Fidelity, PayPal, and Netflix. A significant feature was the persistence of some access: when a victim changed a password, the malware could transmit the updated credential to Genesis Market, allowing the listing to be refreshed. This made the marketplace more useful to fraudsters than a one-time database of old passwords. By the time of the major law-enforcement intervention in April 2023, investigators and public reporting described the marketplace as holding approximately 80 million digital profiles connected to more than two million potential victims. The underlying information was reportedly stolen from about 1.5 million computers. The exact losses enabled by the service were not established, but the Federal Bureau of Investigation attributed at least US$8.7 million in cryptocurrency thefts to activity connected with Genesis Market and stated that aggregate losses were likely in the tens of millions of dollars. These figures describe alleged or investigated criminal proceeds, not revenue earned by a conventional commercial brand. Genesis Market was regarded in 2022 as one of the leading marketplaces of its type, alongside Russian Market and 2Easy. Its differentiation came from usability, breadth of data, and the ability to help customers adopt a victim’s online identity. In practical terms, buyers could use the supplied information to take over accounts, commit payment fraud, impersonate users, or pursue further criminal activity. U.S. Secretary of State Antony Blinken stated that the operation was based in Russia, although the precise identities and organizational structure of the operators have not been publicly established in the cited material. International authorities disrupted the marketplace in April 2023 in an operation known as Operation Cookie Monster. The action was led by the FBI and the Dutch National Police, with Europol coordinating participating agencies. Surface-web domains were seized or taken offline, and enforcement measures were carried out in seventeen countries. Authorities reported 119 arrests and searches of 208 properties. The disruption did not immediately eliminate the brand: within roughly two weeks, a functioning mirror reportedly appeared on the dark web. The longer-term status of the service and any successor operation remains unclear. The Genesis Market case also illustrated the broader consequences of infostealer malware. Dutch investigators worked with Trellix and Computest to analyze Danabot-related infections and share technical indicators with VirusTotal and Microsoft, supporting defensive detection. The Dutch National Police additionally launched CheckYourHack, a public service that allowed people to determine whether an email address appeared in Genesis Market data and receive guidance on reducing exposure. Genesis Market therefore became both a prominent criminal marketplace and a case study in the international response to credential theft, botnet-enabled fraud, and dark-web identity markets.

Genesis Market reportedly began in beta form in 2017 as an English-language marketplace for stolen credentials and access to compromised computers. Its model depended on information-stealing malware, which extracted credentials and other browser or device data from infected machines and transmitted the information to marketplace infrastructure. The resulting listings were marketed as digital profiles. Unlike a conventional password dump, a profile could contain multiple elements needed to impersonate a person online, including credentials, cookies, and information about the victim's device. The service's principal innovation was operational convenience. Its interface enabled buyers to search for and use stolen identities without necessarily developing their own malware infrastructure or manually assembling information from disparate sources. Genesis Market was also associated with persistent access: where malware remained active on a victim's computer, changes to passwords could be relayed back to the marketplace. This increased the practical value of listings and helped fraudsters maintain access after victims attempted to secure their accounts. In December 2020, the FBI, working with another national law-enforcement agency, reportedly copied server data from Genesis Market. The operation captured information associated with approximately 33,000 users of the service. Publicly reported figures later illustrated the marketplace's international reach. In May 2021, it reportedly offered 374,401 target profiles spanning 218 countries. By 2022, it was considered one of the three leading marketplaces of its type, alongside Russian Market and 2Easy. The data offered through the service was associated with credentials for major consumer, social-media, commercial, entertainment, and financial platforms. Reported examples included Airbnb, Amazon, eBay, Facebook, Fidelity, PayPal, and Netflix. The underlying data was said to have been stolen from approximately 1.5 million computers. By the time of the 2023 disruption, investigators and public accounts described approximately 80 million digital profiles connected to more than two million potential victims. The scale of the marketplace led to substantial concerns about account takeover, payment fraud, identity impersonation, and cryptocurrency theft. The FBI reported US$8.7 million in cryptocurrency thefts connected with the service and estimated that total losses were in the tens of millions of dollars. The full extent of harm remained difficult to measure because criminal use of stolen data could continue after the original listing was created and because the same credentials could support multiple fraud schemes. Genesis Market's publicly visible web operations were disrupted in April 2023 through Operation Cookie Monster. The operation was led by the FBI and the Dutch National Police, while Europol hosted a command post to coordinate actions by participating agencies. Police forces in seventeen countries took part, including agencies from the United Kingdom, Australia, Canada, Spain, Italy, Germany, Sweden, Poland, Denmark, and Romania. Authorities reported 119 arrests and searches of 208 properties. U.S. Secretary of State Antony Blinken stated that the marketplace was operated from within Russia. The takedown affected the visible domains but did not immediately end the service's online presence. Within approximately two weeks, a fully functioning mirror was reportedly available on the dark web. The subsequent organizational status, ownership, and continuity of the operation have not been established in the cited material. The Dutch response also included defensive and public-awareness work. The National Police Corps collaborated with Trellix and Computest to analyze Danabot malware and share distinctive infection data with VirusTotal and Microsoft, supporting antivirus detection. It also introduced CheckYourHack, which helped potential victims determine whether an email address appeared in Genesis Market records and provided remediation guidance. The case remains an example of the connection between infostealer malware, underground data markets, and international cybercrime enforcement.

• 2023

  Operation Cookie Monster disrupts the marketplace

  [1]Genesis Marketen.wikipedia.org

  An international operation led by the FBI and Dutch National Police disrupts Genesis Market domains and reports 119 arrests and 208 property searches.

• 2023

  A dark-web mirror reportedly becomes operational

  [1]Genesis Marketen.wikipedia.org

  A functioning mirror reportedly appears within two weeks of the public-facing disruption.

• 2022

  Genesis Market ranks among leading identity marketplaces

  [1]Genesis Marketen.wikipedia.org

  Public reporting identifies Genesis Market as one of the three most prominent marketplaces of its kind, alongside Russian Market and 2Easy.

• 2021

  Marketplace lists hundreds of thousands of international profiles

  [1]Genesis Marketen.wikipedia.org

  In May, Genesis Market reportedly advertises 374,401 target profiles covering 218 countries.

• 2020

  FBI copies Genesis Market server data

  [1]Genesis Marketen.wikipedia.org

  In December, the FBI and an unnamed partner agency reportedly obtain server data associated with about 33,000 marketplace users.

• 2017

  Genesis Market launches in beta

  [1]Genesis Marketen.wikipedia.org

  The marketplace reportedly begins operating as a service for selling stolen credentials and access to compromised computers.

A user-oriented cybercrime marketplace positioned around convenient access to stolen digital identities and compromised devices rather than legitimate consumer products or services.

• Stolen credentials and personal data · 2017

  Digital identity profiles

  Genesis Market offered profiles assembled from information-stealing malware infections. Listings could include usernames, passwords, browser cookies, device information, and related personal data for accounts on services such as Amazon, Facebook, PayPal, Netflix, Airbnb, eBay, and Fidelity. The profiles were intended to support impersonation, account takeover, payment fraud, and other criminal activity.

• Compromised-device access · 2017

  Persistent computer access

  The marketplace was known for selling access associated with infected computers. Because the underlying infostealer malware could remain active, updated credentials could be sent back to the service after a victim changed a password. This persistence made the listings more valuable to fraudsters than static collections of previously stolen passwords.

• 2023

  International criminal investigation and marketplace takedown

  Genesis Market was targeted in Operation Cookie Monster after being linked to the distribution of stolen credentials, personal information, and persistent access to infected computers. Authorities reported 119 arrests and 208 property searches across seventeen countries.

  Source

• 2023

  Credential theft and alleged cryptocurrency losses

  The FBI reported US$8.7 million in cryptocurrency thefts connected with Genesis Market activity and said overall losses were estimated to reach tens of millions of dollars. The service's data was reportedly stolen from about 1.5 million computers and exposed more than two million potential victims.

  Source

Read more

• 2023CheckYourHack

  Netherlands · International online users

  The Dutch National Police introduced CheckYourHack to let people check whether an email address appeared in Genesis Market data. The service also supplied advice intended to help affected users reduce their exposure and secure accounts.

  Outcome. The initiative provided a public-facing victim-notification and remediation channel connected with the investigation.

  Source

• 2023

  International authorities coordinate a multinational takedownStrategy

  Background

  Genesis Market operated across borders and offered data relating to victims in many countries, requiring coordinated action by multiple law-enforcement agencies.

  Action taken

  The FBI and Dutch National Police led Operation Cookie Monster, with Europol coordinating participating agencies and authorities disrupting the marketplace's public-facing domains.

  Aftermath

  Authorities reported 119 arrests and 208 searches. A functioning dark-web mirror reportedly appeared within roughly two weeks, so the disruption did not immediately eliminate the service's wider online presence.

  Cryptocurrency thefts attributed by the FBI. US$8.7 million reported in connected cryptocurrency thefts; total losses estimated in the tens of millions of dollars (As reported in connection with the 2023 investigation)

  Source

1. 1Genesis Marketen.wikipedia.org