FBI Crushes Nulled & Cracked.io, but Cybercriminals Already Have a Backup Plan

The FBI just shut down Nulled.to and Cracked.io, two of the biggest cybercrime forums, in a major takedown operation. But while law enforcement celebrates, the reality is clear: cybercriminals are already regrouping elsewhere.

With hacking forums facing increasing pressure, many are pivoting to Telegram “dark web” clouds: fast, encrypted, and nearly impossible to regulate. Here’s how the underground hacking scene is evolving right now.

From Forum Takedowns to Telegram Takeovers

In January 2025, visitors to Nulled.to and Cracked.io were greeted with an FBI seizure notice. The crackdown, dubbed Operation Talent, marked another major effort by international law enforcement to disrupt cybercrime networks.

But if history tells us anything, these forums, or their successors, will resurface under different names, domains, or platforms.

And Telegram is already filling the void.

Why Telegram? The New Cybercrime Playground

The shift from forums to Telegram-based “dark web” clouds isn’t surprising. Cybercriminals are opting for Telegram because:

• It’s Encrypted. No need for VPNs, Tor, or PGP.
• Instant Setup. Channels and groups can be created in seconds.
• Automation. Bots handle log sales, memberships, and payments.
• Difficult to Track. Unlike forums with web domains, Telegram groups are harder to seize.

With law enforcement cracking down on forums, Telegram “clouds” have emerged as the go-to alternative for selling stolen data.

Inside Telegram’s Underground “Clouds”

Telegram is now home to cybercriminal groups disguised as “data repositories” or “clouds.” These groups are structured like tiered marketplaces:

• Tier 1, Malware Operators: Run phishing campaigns and infostealers.
• Tier 2, Data Brokers: Organize, clean, and repackage stolen credentials.
• Tier 3, Resellers: Flood Telegram with “exclusive” stolen data offers.

Some of the most active groups right now include:

• Titanic Cloud: Specializes in stolen email and cPanel logins.
• Blue Cloud: Focused on credentials for Netflix, PayPal, and more.
• TrustCloud: Markets itself as an “exclusive” collection of fresh 2023 to 2024 logs.

Most of these so-called “fresh logs” are actually recycled dumps renamed and repackaged for resale.

What’s Being Sold?

Telegram cybercrime groups trade in:

• Streaming Accounts: Netflix, Hulu, Disney+, etc.
• Email & SMTP Logins: Used for spam and phishing campaigns.
• Web Hosting Credentials: cPanel, phpMyAdmin, WordPress, etc.
• SSH/RDP Access: Critical for cryptomining and corporate breaches.
• Combo Lists: Username-password pairs for credential stuffing attacks.

All of this is fully automated. Buyers simply interact with a bot, pay in crypto, and download stolen data, with no need for forum accounts or admin approvals.

Law Enforcement vs. Cybercriminals: The Endless Cat-and-Mouse Game

Seizing hacking forums like Nulled and Cracked.io is a temporary win, but it doesn’t eliminate the underlying issue. Cybercriminals adapt faster than law enforcement can shut them down.

Here’s what happens next:

1. Telegram Continues to Grow. More “clouds” pop up, moving beyond just credential sales.
2. Decentralized Markets Expand. Cybercriminals move to peer-to-peer platforms outside Telegram.
3. More AI-Driven Cybercrime. Attackers leverage automation and AI-driven phishing.

Law enforcement will continue to take down major forums, but as long as platforms like Telegram remain operational, cybercrime will find a way to thrive.

Mitigation Strategies: How to Stay Ahead

• Enable Multi-Factor Authentication (MFA). A stolen password is useless without a second factor.
• Monitor for Leaked Credentials. Businesses should track if employee logins appear in these Telegram groups.
• Report Suspicious Groups. While Telegram takes time to respond, mass reporting can help disrupt cybercriminal activity.
• Educate Employees. Preventing phishing and malware infections reduces the number of stolen credentials.

Final Thoughts: Takedowns Are Just the Beginning

Shutting down cybercrime forums is important, but it’s not the end of the problem, it’s just a new chapter. The real battlefield is shifting from traditional hacking forums to Telegram, where data moves faster, cheaper, and with fewer restrictions.

As law enforcement plays Whac-A-Mole with cybercriminals, security professionals and businesses must stay ahead by understanding the new threat landscape.

Because if history has proven anything, this game never ends.

Note

This article is based on real-world research into public Telegram groups and does not encourage illegal activity. Always adhere to legal and ethical guidelines when investigating cybersecurity threats.

First published on Medium on 30 January 2025.