International Law Enforcement Takedown of LeakBase Cybercrime Marketplace
Regulatory & Policy · 2 sources · Updated 4mo ago · First seen Mar 6, 2026

An international law-enforcement operation involving the FBI, Europol, and authorities across 14 countries seized infrastructure used by LeakBase, a major cybercrime marketplace/forum used to trade stolen data, exploits, and hacking services. Investigators reportedly seized LeakBase domains, displayed seizure banners, executed search warrants, and made arrests; forum data (including user accounts, messages, and IP logs) was preserved to support follow-on investigations and deterrence efforts.
Separate reporting in the same news cycle described other unrelated cyber developments, including Europol-led disruption of the Tycoon2FA phishing-as-a-service platform (used for adversary-in-the-middle MFA bypass), a guilty plea tied to the Phobos ransomware operation, a newly documented China-linked espionage cluster (CL-UNK-1068) targeting critical sectors in Asia, an unverified ShinyHunters extortion claim against Woflow, suspected DPRK-linked intrusions against cryptocurrency firms, and a pro-Iranian/pro-Palestinian ransomware ecosystem shift from Sicarii to BQTLock. Those items do not materially change the core LeakBase takedown but indicate continued pressure on cybercrime infrastructure alongside ongoing ransomware and espionage activity.


