Skip to content
June 22, 2026
  • Linkedin
  • Twitter
  • Facebook
  • Youtube

Daily CyberSecurity

Zero-hour alerts. Unmatched analysis.

Primary Menu
  • Home
  • CVE Watchtower
  • Cyber Criminals
  • Data Leak
  • Linux
  • Malware
  • Vulnerability
  • Submit Press Release
  • Vulnerability Report
Light/Dark Button
  • Home
  • News
  • Cyber Security
  • Dark web marketplace RaidForums shuts down
  • Cyber Security

Dark web marketplace RaidForums shuts down

Do Son April 12, 2022 2 minutes read
RaidForums shuts down
Add as a preferred
source on Google

According to the news released by the U.S. Department of Justice on April 12, the international law enforcement operation TOURNIQUET, led by the United States, coordinated by the Europol-European Cybercrime Center, and jointly participated by law enforcement agencies of the United Kingdom, Sweden, Portugal, and Romania, recently, the illegal Dark web marketplace RaidForums shuts down, and related infrastructure assets were confiscated.

During the operation, law enforcement arrested three suspects, including the founder and CEO of RaidForums, Diogo Santos Coelho, a 21-year-old Portuguese national. Police arrested Coelho in the U.K. on January 31 on criminal charges brought by the U.S.

RaidForums was founded in 2015 and has more than 500,000 community users. It has long targeted companies in various industries in the United States and sold the stolen data, including information on millions of credit cards, bank accounts, and routing information, as well as usernames and related passwords for a large number of online accounts.

“This marketplace had made a name for itself by selling access to high-profile database leaks belonging to a number of US corporations across different industries. These contained information for millions of credit cards, bank account numbers and routing information, and the usernames and associated passwords needed to access online accounts.” reads the announcement published by Europol. “These datasets were obtained from data breaches and other exploits carried out in recent years.”

In order to profit from the platform, under the operation strategy of Coelho, RaidForums also conducts membership business internally and obtains the corresponding membership level by paying different fees to obtain the corresponding access rights and functions, if you want to “unlock” some high-value stolen information, the user must become a higher-level member by recharging. Members can also earn points in other ways, such as posting action tutorials related to illegal behavior.

According to Europol, joint efforts and close information sharing were keys to the success of Operation TOURNIQUET, allowing investigators to determine the structure of RaidForums and the roles and responsibilities of the members behind them. In the future, Europol will continue to work with other countries to combat cybercrime.

Related coverage

  • FBI/CISA Warn: Pro-Russia Hacktivists Target Critical Infrastructure Via Unsecured VNC HMIs
  • MonoSwap Hacked: Urgent Withdrawal Alert
  • New CRESCENTHARVEST Malware Targets Iranian Dissidents
  • Allanite Hackers Group Aims ICS Networks at Electric Utilities in US, UK
  • Supply Chain Poison: Lotus Blossom Hits Notepad++ to Deploy “Chrysalis”

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee Logo Buy Me a Coffee PayPal
Crypto QR Code
USDT (TRC20):
TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm
USDT (ERC20):
0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce

Share this article:

Facebook Post LinkedIn Telegram
Written by
@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.

Tags: RaidForums RaidForums shuts down

Search

Translation

CVE WATCHTOWER
🚨

Receive alerts for vulnerabilities being exploited in the wild.

⚡

Get notified instantly when a Proof of Concept (PoC) exploit is published.

🔍

Access critical info on vulnerabilities even when marked as "RESERVED".

🧠

Insights powered by decades of expertise and global intelligence sources.

🎯

Customize alerts with up to 10 keywords for your specific tech stack.

📊

Export the raw CVE database for SIEM integration and reporting.

Upgrade Package

🔴 Live Critical Threats

  • CVE-2026-33646CVSS 9.6
    ## Summary Mise processes `.tool-versions` files through the Tera template engine during...
  • CVE-2026-10789CVSS 9.6
    A maliciously crafted webpage, when visited by a user with Autodesk Fusion...
  • CVE-2026-7664CVSS 9.8
    IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access...
  • CVE-2026-28381CVSS 9.6
    The Snowflake datasource allows for GET/PUT commands, which can allow any user...
  • CVE-2026-10561CVSS 10.0
    IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an...
  • CVE-2026-11373CVSS 9.1
    Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a...
  • CVE-2026-56395CVSS 9.6
    SiYuan before v3.6.1 fails to sanitize package metadata and README content in...
  • CVE-2026-56265CVSS 9.8
    Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded...
  • CVE-2026-5366CVSS 9.9
    Prefect version 3.6.23 is vulnerable to remote code execution due to improper...
  • CVE-2024-58351CVSS 9.8
    Flowise before 2.1.4 allows configuration to be injected into the Chainflow during...
Powered by CVE WATCHTOWER

🚨 Active Exploits in the Wild

  • CVE-2026-20230CVSS 8.6
    A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified...
  • CVE-2026-4020CVSS 7.5
    The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and...
  • CVE-2026-10735
    Multiple plugins by ShapedPlugin contain a backdoor in various versions. This makes it possible for unauthenticated attackers to...
  • CVE-2026-20262CVSS 6.5
    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated,...
  • CVE-2026-54420CVSS 8.5
    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a...
  • CVE-2026-53435CVSS 8.8
    In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize...
  • CVE-2026-10795CVSS 8.1
    The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions...
  • CVE-2026-11645
    Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker...
  • CVE-2026-50751CVSS 9.3
    A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows...
  • CVE-2026-20245CVSS 7.8
    A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, local...
Powered by CVE Watchtower

Our Websites
  • Penetration Testing Tools
  • The Daily Information Technology
  • Daily CyberSecurity

    • About SecurityOnline.info
    • Advertise with us
    • Announcement
    • Contact
    • Contributor Register
    • Login
    • About SecurityOnline.info
    • Advertise on SecurityOnline.info
    • Contact Us

    When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works

    • Disclaimer
    • Privacy Policy
    • DMCA NOTICE
    • Linkedin
    • Twitter
    • Facebook
    • Youtube
    © 2017 - 2026 Daily CyberSecurity. All Rights Reserved.