The biggest marketplace for stolen credentials, UniCC announces shutdown

The marketplace on the dark web where stolen credit card information gets sold is shutting down operations after $358 million in earnings

Carding platform announces retirement due to age and health of operators

UniCC is the site where criminals manage to make money after their data exfiltration operations and where other threat actors manage to get needed credentials for further scams and attacks. The site shut down of the operations was announced by the team.^[1]

Since 2013 when the site started to work, these creators have made at least $358 million in various cryptocurrencies like Ether, Bitcoin, Dash, Litecoin.^[2] It is believed that these earnings are enough for criminals to retire finally, so the operations can be stopped. It is based on the retirement notice that was published in Russian and English dark web forums in both languages.

Don't build any conspiracy theories about us leaving. It is weighted decision, we are not young and our health do not allow to work like this any longer.

The platform specializes in credit card fraud and sales of stolen details that later can be used to make payments and unauthorized transactions to cloned cards. this is called carding and can lead to identity theft.^[3] Anonymous hackers gave 10 days for the users, so balances on the platform can be spent before the domain, and affiliated sites close.

Malicious marketplace for skimmers and fraudsters

The main function of such platforms is to act as the underground market where payment card details that get stolen from online retailers, banks, companies can be exchanged for money – cryptocurrency. Skimmers get injected^[4] on various platforms, and these credentials are stolen in various attacks. With these funds, cybercriminals can purchase other hacking tools online or exchange funds for high-value items.

These procedures became popular and one of the common tools used by threat actors. The method ensures profits and can help launder money, cash-out funds obtained using other tools and methods of cyberattacks. Threat actors always had the thing for exfiltrating data because most of the obtained details can be valuable either for them or other malicious criminals.

These marketplaces receive new listings every day, and those numbers can vary from hundreds to hundreds of thousands of new credit cards each day. UniCC particularly controlled 30 percent of the stolen payment card detail market, so it is a matter of time which one of the left platforms will take over the top.

Another year another sunset

Almost a year ago, one of the largest platforms based on the same carding method shut down too.^[5] Joker's Stash announced the retirement while it was one of the largest forums. The particular platform was the market leader and managed to raise up to $400 million in stolen cards.

The UniCC quickly jumped to the top spot on the market share charts then. Joker Stash was closed due to the hospitalization of the main operator. The Covid-19 affected criminal activities, and the service with all associated domains got closed.

Researchers can still see that many not-so-big marketplaces also shut down. The White House Market announced the shutdown in October. Cannazon domain also was closed. Torrez platform got closed back in December. The unexpected shutdown was also observed on the Monopoly market service.

These issues might be linked to more common law enforcement operations that focus on fraud and cybercrime more in-depth. Fear can always push criminals to stop operations. It is believed that this wave of marketplace shutdowns triggered the retirement of UniCC services.