Loading story…
Liridon Masurica, a Kosovo national, has pleaded guilty to running the BlackDB.cc cybercrime marketplace from 2018 to 2025. The platform sold stolen credentials, credit card data, and PII, primarily targeting U.S. victims, enabling widespread identity theft and fraud. Masurica was arrested in Kosovo, extradited to the U.S., and faces up to 55 years in prison, with sentencing pending.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
5 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcedatabreaches.net
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kosovar national **Ardit Kutleshi** pleaded guilty in the United States to aggravated identity theft and money-laundering conspiracy for creating and operating the Rydox illicit marketplace. From February 2016 until its December 2024 takedown, Rydox offered stolen credentials, payment-card and personal data, device access, and other fraud-enabling products, serving more than 18,000 users and facilitating over 7,600 transactions worth about $232,000. The platform listed more than 321,000 cybercrime-related products and exposed data belonging to thousands of U.S. citizens. U.S., Kosovo, Albanian, and Malaysian authorities dismantled Rydox in a coordinated December 2024 operation that arrested Kutleshi and fellow administrators Jetmir Kutleshi and Shpend Sokoli, seized the `Rydoc.cc` domain, and confiscated marketplace servers in Kuala Lumpur. Kutleshi was extradited from Kosovo in 2025 and is scheduled for sentencing on February 9, 2027; he faces a mandatory minimum two-year term for aggravated identity theft and up to 20 years for money laundering.
Sep 25, 2026
Alan Bill, a 33-year-old Slovak national, was sentenced in the United States to 200 months in federal prison for helping operate **Kingdom Market**, a major darknet marketplace that sold illegal drugs and cybercrime-related goods. Bill pleaded guilty to conspiracy to distribute controlled substances after admitting he provided web administration, managed cryptocurrency tied to the site, and promoted the marketplace on Reddit, Dread, and other social platforms. Prosecutors said Kingdom Market operated from March 2021 through December 2023 and facilitated thousands of transactions involving narcotics, stolen financial data, fake identity documents, counterfeit currency, and malware. Investigators said undercover purchases on the platform included fentanyl, methamphetamine, and a fake U.S. passport, while seized server records showed trafficking in heroin and purported Oxycodone cut with fentanyl. Bill was arrested at Newark Liberty International Airport on December 15, 2023, shortly before German authorities seized the marketplace’s servers and shut it down in a multinational operation involving the United States, Germany, Switzerland, Moldova, and Ukraine. The court rejected Bill’s effort to downplay his role, finding he acted as a leader in the conspiracy, and ordered the forfeiture of multiple cryptocurrency assets and the domains `Kingdommarket[.]live` and `Kingdommarket[.]so`.
Jun 29, 2026
Ukrainian national **Mark Sokolovsky** was sentenced to five years in prison for his role in operating **Raccoon Stealer**, a malware-as-a-service infostealer that prosecutors said was rented to other criminals for **$75 per week** or **$200 per month** in cryptocurrency. U.S. authorities said the platform infected millions of computers and stole more than **52 million credentials** along with cryptocurrency wallets, payment card data, email records, and other sensitive information later used in fraud, identity theft, and ransomware attacks. Sokolovsky was arrested in the Netherlands in March 2022, extradited to the United States in February 2024, and later pleaded guilty after being charged with fraud, money laundering, and aggravated identity theft. The case followed a coordinated FBI and European law enforcement operation that dismantled Raccoon Stealer infrastructure in the Netherlands and Italy and led to the launch of the FBI victim-notification portal at `raccoon.ic3.gov`. Independent research by Team Cymru linked Raccoon’s management activity to **Kharkiv, Ukraine**, identified a Tor-based customer panel and Telegram update server, and tied the operation to the **CC2BTC** stolen-card marketplace, suggesting the operators monetized victim data both by leasing the malware and by reselling stolen payment cards. Despite the takedown, the malware family later resurfaced as **Recordbreaker**, also described as **Raccoon Stealer v2**, with a rewritten codebase and updated delivery and exfiltration features.
Aug 15, 2026