A new report out today from threat intelligence firm KELA Research and Strategy Ltd. details the rapid ascent and leadership behind DarkForums, a cybercrime platform that’s filling the void left by the takedown of BreachForums earlier this year.

BreachForums, which for years had been a key player in the cybercrime community, was finally taken down following the arrest of the site’s founder in 2023 and then the arrest of its leaders, including ShinyHunters and IntelBroker, in June.

With BreachForums out of the way, DarkForums seized the opportunity to take its place, growing 600% between April and June. The site itself was originally launched in November 2022 under the name “DARK4RMY Forums,” before later rebranding as the more simple DarkForums.

DarkForums is described in the report as a thriving hub for data leaks, malware distribution and hacking tools, designed to mirror BreachForums both visually and operationally. It adopted its design (see image above) and even acquired the original BreachForums Telegram user group.

The forum is closely linked to the Indian-based DarkArmy hacking group, led by administrators known as “Lucifer” and “MrR0b0t.” Lucifer, a programmer and self-proclaimed ethical hacker from Balangir, India, was the original manager of the site. But in contrast to what was previously seen on BreachForums, it offers aggregated content rather than initiating original attacks.

According to KELA’s researchers, Lucifer displayed poor operational security and left behind extensive digital footprints, including various email addresses, GitHub archives and inactive social media profiles. He retired in August 2024, handing over control of DarkForums to a person known as “Knox.”

Knox, who registered on the forum in mid-2023 and became highly active on the site after Lucifer’s retirement, followed a similar pattern of aggregating leaks from other sources. KELA notes that Knox’s prior alias was “Asmodeus,” hinting at a perhaps personal obsession with Luciferian mythology. Though unconfirmed, there is also some suggestion that Knox may be from Indonesia.

Another key DarkForums figure, known as “AnonOne,” emerged as an early administrator whose online activities overlapped significantly with Lucifer’s, including nearly identical posts across multiple platforms such as HydraMarket and BreachForums. KELA suspects this persona might have been strategically constructed by DarkForums’ administration for credibility and image enhancement.

The forum’s initial moderators and early administrators, “MrR0b0t” and “MrNoiz,” were also traced by the KELA researchers and found to have extensive digital traces. MrR0b0t was found to be based in Haryana, India and was linked to various public platforms, including accounts on Instagram and GitHub. MrNoiz was found to live in the U.S. and later transitioned to a new digital identity, “SPYDIR,” whose real-life credentials were inadvertently exposed through malware infections.

Though the details sound like the base for a Netflix documentary, the report from KELA concludes by suggesting that though an emerging alternative to BreachForums, DarkForums’ administrators lack the operational sophistication of their BreachForums predecessors, serving primarily as content aggregators rather than active threat initiators.

That aside, the rapid rise of DarkForums, coupled with noticeable operational security weaknesses, suggests the platform could remain a significant player in cybercrime and is certainly worth keeping an eye on.

Image: DarkForums