Genesis Market, the darknet hacking marketplace, is still in operation despite police claiming they had taken it down in an international sting.

An international cohort of police claimed to have shutdown the site in Operation Cookie Monster on 5 April, lead by the FBI and Dutch authorities.

In the initial sting, carried out in part by the UK’s National Crime Agency (NCA), 120 people were arrested, 24 of which were in the UK.

As reported by the BBC, an ‘identical’ market remains online on the darknet.

Genesis Market served as a ‘go to service’ for cybercriminals looking for bots and hacking services.

At the time of the take down operation, Genesis had about 80 million sets of credentials and digital fingerprints up for sale. 1.5 million bots were found on the website, as well as about 2 million identities.

The site was one of the most ‘significant marketplaces’ for cybercriminals to source services, according to Rob Jones, NCA Director General at the time of the take down.

The sting was considered a major step in halting the rise of cybercrime, but now the marketplace appears to be functional once again.

Netacea, a cyber-security company, which monitored the darknet marketplace, say that the website is back up and running after being down for about two weeks, as reported by the BBC.

“Taking down cybercrime operations is a lot like dealing with weeds,” Cyril Noel Tagoe, Principal Security Researcher at Netacea told DIGIT.

“If you leave any roots, they will resurface. Law enforcement was able to seize the Genesis Market’s clearnet domains but the roots of Genesis Market’s operation, namely the administrators, darknet domain and malware infrastructure, have survived.”

Recommended

• NCSC and ICO Collaborate in Cyber-attack Transparency Push
• DirectID Enters Partnership to Provide Stable Income to Freelancers
• Report: Majority of Businesses ‘Uncomfortable’ with Data Ethics Practices

The marketplace has now been updated by its administrators, who claim to have released a newer version of their site. They also claim to have continued collecting data from compromised devices and increased their victim list.

It appears that the previous shutdown by police was more of a disruption as the site is currently active.

“To fully takedown a cyber crime operation such as the Genesis Market, you need to seize and dismantle all its infrastructure and prosecute the administrators. However, there are many complicating factors,” Tagoe explained.

“To start with, it is very difficult to locate the servers behind hidden darknet services, and law enforcement can’t shut down a server they can’t find. Secondly, jurisdiction can play a major role even if the location of the servers is known. Certain jurisdictions, for example Russia, offer a haven from western law enforcement.”

As the story develops, the Dutch Police have created a portal where concerned people can check if their digital identity was found at the marketplace at the time of the sting.