Loading threat actor…
B1ack’s Stash is a dark web carding marketplace focused on trafficking stolen payment-card data and associated victim information. Active since at least 2023, it has been described as one of the more active illicit card shops in the carding ecosystem. The operation is associated with the alias B1ack, an actor reportedly active in Russian-speaking cybercriminal forums and recognized in the underground card-fraud scene. The marketplace has used both English and Russian in its communications. The operation’s core activity is the sale and distribution of stolen card records, including full payment-card details and related personal data suitable for card-not-present fraud, identity theft, and follow-on phishing. Reported datasets tied to the marketplace have included highly complete records, suggesting sourcing from e-skimming and phishing campaigns. B1ack’s Stash has also repeatedly used large free releases of stolen card data as a marketing and notoriety tactic to attract users and reinforce marketplace credibility. In one notable pattern, the operators publicly released millions of stolen card records after accusing sellers of reselling inventory on competing platforms, while suspending additional records from active inventory. Victim exposure has been heavily concentrated in the United States, with additional significant impact reported in Canada, the United Kingdom, France, and Malaysia, indicating an international victim base rather than a single-region operation. The actor’s activity is financially motivated and centered on monetizing stolen financial data within the broader carding ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cybercriminal carding forum involved in distributing stolen payment card data, using large free data releases both as punishment within its marketplace and as a marketing tactic to attract users and build notoriety.
A carding marketplace operating on the dark web that distributes stolen payment card data and uses large free data dumps as both punishment for sellers and a marketing tactic to attract users and drive traffic.
Dark web carding marketplace operating since at least 2023 that buys and sells stolen payment card data and periodically releases millions of stolen credit card records for free to grow its user base, reinforce marketplace credibility, and police seller behavior.
Underground vendor ecosystem involved in trafficking stolen financial data, including payment-card records; associated domains were seized by authorities.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.