Loading story…
The U.S. Treasury sanctioned Iran-based Behrouz Parsarad, identified as the sole administrator of the Nemesis darknet marketplace, after authorities said the platform facilitated nearly $30 million in drug sales worldwide between 2021 and 2024, including fentanyl-linked trafficking into the United States. Treasury said Nemesis had more than 30,000 active users and 1,000 vendors, and also offered false identification documents and hacking services. U.S., German, and Lithuanian law enforcement seized Nemesis servers in March 2024, while OFAC designated Parsarad under Executive Order 14059 and published 49 virtual currency addresses tied to him, alleging he controlled marketplace wallets and laundered cryptocurrency for narcotics traffickers and cybercriminals.
UK and European investigations show how the same dark web ecosystem continued to generate arrests and seizures after the takedown. In Cambridgeshire, two drug dealers linked to the Gorgonites Telegram handle and Nemesis Market were sentenced after investigators recovered parcel labels, order lists, packaging, and credentials for multiple marketplace accounts. Separately, the Metropolitan Police seized AEGIS Marketplace after infiltrating the site and obtaining server data identifying administrators, sellers, and customers, while ERSOU arrested two suspects in Romania tied to the Online Killers Marketplace murder-for-hire scam and seized large amounts of cryptocurrency and cash. The cases underscore how Telegram, Tor, and cryptocurrency remain central to illicit online trade, but also how infrastructure seizures, undercover access, blockchain tracing, and identity pivoting are enabling law enforcement disruption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Treasury said the Nemesis darknet marketplace operated from 2021 to 2024, serving more than 30,000 active users and 1,000 vendors and facilitating nearly $30 million in drug sales worldwide. It also offered false identification documents and professional hacking services.
On 2025-03-04, OFAC sanctioned Iran-based Behrouz Parsarad, identified as the sole administrator of the Nemesis darknet marketplace. Treasury also identified 49 virtual currency addresses linked to him and said he had discussed creating a replacement marketplace after Nemesis was taken down.
FinCEN published a supplemental advisory focused on fentanyl-related illicit finance. The reference indicates the advisory document was issued on 2024-06-20.
On 2024-03-20, U.S., German, and Lithuanian law enforcement seized servers used by the Nemesis darknet marketplace. Treasury later cited the action as part of the marketplace's 2024 takedown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcehome.treasury.gov
Open sourcefincen.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US and international law enforcement continued disrupting illicit online marketplaces and forums used to trade **ransomware services, malware, stolen data, and drugs**. The FBI seized the dark web and clear web domains for **RAMP**, a long-running, predominantly Russian-language cybercrime forum that marketed itself as the “only place ransomware allowed,” and which hosted vetted users, tutorials, and a marketplace for malware and criminal services; the seizure was coordinated with the US Attorney’s Office for the Southern District of Florida and DOJ’s Computer Crime and Intellectual Property Section. Separately, US prosecutors announced guilty pleas tied to major darknet markets that also sold **cybercrime tools and stolen information** alongside narcotics. A Virginia man, **Raheim Hamilton** (aka `Sydney`/`ZeroAngel`), co-creator of **Empire Market**, pleaded guilty to federal drug conspiracy charges related to facilitating roughly **$430M** in transactions (2018–2020) and designing the market to evade law enforcement using cryptocurrency. A Slovakian national, **Alan Bill** (aka `Vend0r`/`KingdomOfficial`), pleaded guilty for helping operate **Kingdom Market** (2021–2023), which authorities previously seized in December 2023; investigators linked him to the operation after his arrest with devices and a crypto hardware wallet allegedly containing evidence tying him to the marketplace.
Jun 29, 2026
Darren Hughes of San Jose, California, was sentenced to more than 26 years in federal prison for trafficking fentanyl and methamphetamine through **Nemesis Market**, a major dark web marketplace. Prosecutors said Hughes operated a vendor store on the site, sold narcotics in exchange for cryptocurrency, sent free methamphetamine samples, and completed multiple sales to an undercover law enforcement agent before his June 2023 arrest. When Redwood City police arrested Hughes after arranging another sale, officers found about **672 grams of methamphetamine** and a loaded unserialized **9mm ghost gun** in his vehicle. The case was part of a broader international crackdown on Nemesis Market, which launched in 2021, grew to more than **150,000 user accounts** and over **400,000 orders**, and was dismantled in March 2024 by German and U.S. authorities with support from the FBI, DEA, IRS-CI, and European partners.
Jun 29, 2026
US federal courts issued prison sentences tied to **darknet-enabled drug trafficking**. In Los Angeles, **Davit Avalyan** received a **57-month** sentence after pleading guilty to conspiracy to distribute narcotics as part of a multi-year operation that used numerous darknet vendor accounts/storefronts (e.g., *JoyInc*, *PlanetHollywood*, *LaFarmacia*) to sell cocaine, methamphetamine, MDMA, and ketamine nationwide, taking payment in cryptocurrency including **Bitcoin** and **Monero**, and shipping parcels via **USPS**. Separately, reporting on the **Incognito** darknet market case describes sentencing filings alleging that an **FBI-controlled informant/asset** helped administer the marketplace while opioid and fentanyl-tainted products were sold, including claims the informant ignored internal alerts and user complaints about suspected fentanyl-laced pills. A third item—about a Ukrainian national sentenced for facilitating **North Korean remote IT worker infiltration** using stolen identities and US-based “laptop farms”—is a different national-security/cyber-enabled fraud matter and not part of the darknet drug-market sentencing story.
Jun 29, 2026