Loading story…
Kosovar national Ardit Kutleshi pleaded guilty in the United States to aggravated identity theft and money-laundering conspiracy for creating and operating the Rydox illicit marketplace. From February 2016 until its December 2024 takedown, Rydox offered stolen credentials, payment-card and personal data, device access, and other fraud-enabling products, serving more than 18,000 users and facilitating over 7,600 transactions worth about $232,000. The platform listed more than 321,000 cybercrime-related products and exposed data belonging to thousands of U.S. citizens.
U.S., Kosovo, Albanian, and Malaysian authorities dismantled Rydox in a coordinated December 2024 operation that arrested Kutleshi and fellow administrators Jetmir Kutleshi and Shpend Sokoli, seized the Rydoc.cc domain, and confiscated marketplace servers in Kuala Lumpur. Kutleshi was extradited from Kosovo in 2025 and is scheduled for sentencing on February 9, 2027; he faces a mandatory minimum two-year term for aggravated identity theft and up to 20 years for money laundering.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Ardit Kutleshi was extradited from Kosovo to the United States to face charges connected to his alleged operation of Rydox.
Kosovo and Albanian authorities arrested Ardit Kutleshi and other alleged Rydox administrators during a joint international operation. Authorities shut down the marketplace and seized the Rydox[.]cc domain, while Malaysian police seized servers in Kuala Lumpur.
Rydox began operating by February 2016, selling stolen credentials, payment-card data, personal information, and cybercrime tools. Through its 2024 shutdown, it facilitated more than 7,600 sales and offered more than 321,000 additional products to over 18,000 users.
Ardit Kutleshi pleaded guilty in the United States to aggravated identity theft and money-laundering conspiracy for his role operating the Rydox illicit marketplace.
Kutleshi's brother, also accused of operating Rydox, previously pleaded guilty, received a time-served sentence, and was deported to Kosovo in December.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Liridon Masurica, a Kosovo national, has pleaded guilty to running the BlackDB.cc cybercrime marketplace from 2018 to 2025. The platform sold stolen credentials, credit card data, and PII, primarily targeting U.S. victims, enabling widespread identity theft and fraud. Masurica was arrested in Kosovo, extradited to the U.S., and faces up to 55 years in prison, with sentencing pending.
Jun 29, 2026
A Jordanian national, **Feras Khalil Ahmad Albashiti** (aliases including **“r1z,” “Feras/Firas Bashiti”**), pleaded guilty in U.S. federal court to **fraud and related activity in connection with access devices** for acting as an **initial access broker** who sold unauthorized access to victim networks. Prosecutors said Albashiti used the **Russian-language cybercrime forum XSS** (XSS.is / XSS.pro) and, in May 2023, sold an undercover law enforcement officer unauthorized access to the networks of **at least 50 companies** in exchange for cryptocurrency; the charge carries a maximum penalty of **10 years in prison** and significant fines, with sentencing scheduled for **May 2026**. Court reporting adds that Albashiti’s dealings with an undercover FBI agent included selling a **cracked penetration-testing tool**, then offering access to dozens of companies via **two firewall exploitation methods** for about **$5,000**, and later marketing an **“EDR killer”** capability; the FBI paid **$15,000** for a version of malware described in filings as “novel” and effective at disabling multiple EDR products. Investigators attributed an IP address linked to Albashiti to activity associated with a **June 2023 ransomware attack** against a U.S. manufacturing firm that reportedly caused roughly **$50 million** in damage, and they tied the “r1z” account to Albashiti via an email address also used in a prior U.S. visa application; he was residing in **Tbilisi, Georgia**, and was **extradited to the U.S. in July 2024** before reaching a plea deal.
Jun 29, 2026
Ukrainian national **Mark Sokolovsky** was sentenced to five years in prison for his role in operating **Raccoon Stealer**, a malware-as-a-service infostealer that prosecutors said was rented to other criminals for **$75 per week** or **$200 per month** in cryptocurrency. U.S. authorities said the platform infected millions of computers and stole more than **52 million credentials** along with cryptocurrency wallets, payment card data, email records, and other sensitive information later used in fraud, identity theft, and ransomware attacks. Sokolovsky was arrested in the Netherlands in March 2022, extradited to the United States in February 2024, and later pleaded guilty after being charged with fraud, money laundering, and aggravated identity theft. The case followed a coordinated FBI and European law enforcement operation that dismantled Raccoon Stealer infrastructure in the Netherlands and Italy and led to the launch of the FBI victim-notification portal at `raccoon.ic3.gov`. Independent research by Team Cymru linked Raccoon’s management activity to **Kharkiv, Ukraine**, identified a Tor-based customer panel and Telegram update server, and tied the operation to the **CC2BTC** stolen-card marketplace, suggesting the operators monetized victim data both by leasing the malware and by reselling stolen payment cards. Despite the takedown, the malware family later resurfaced as **Recordbreaker**, also described as **Raccoon Stealer v2**, with a rewritten codebase and updated delivery and exfiltration features.
Aug 15, 2026