The Bundeskriminalamt (BKA), FBI and DEA have seized the infrastructure of the darknet marketplace ‘Nemesis,’ which dealt in drugs, cybercrime services, and illicit credit cards. The operation led to the seizure of criminal servers in Lithuania and Germany and the confiscation of €94,000 worth of cryptocurrency, with investigations ongoing to identify users and operators of the platform. As of now, Francis seems to be safe, but has called vendors to clean up houses.
Key Insights
‘Nemesis’ was founded in 2021 and had over 150,000 user accounts and 1,100 vendor profiles.
Approximately 20% of the users were based in Germany.
The marketplace offered narcotics, fraudulently obtained data and goods, and cybercrime services.
Authorities seized criminal servers in Lithuania and Germany, and €94,000 worth of cryptocurrency was confiscated.
The seizure notice was followed by a warning from head admin named Francis.
The investigation began in October 2022.
The U.S. Department of Justice stated that investigations against administrators and vendors are ongoing.
Another marketplace called ‘Kingdom Market’ was seized in December 2023.
Düsseldorf Police recently seized ‘Crimemarket,’ another darknet platform.
Cybercrime experts suggest that ‘Nemesis’ operators might resume activities under a new domain.
An international investigation led by the Bundeskriminalamt (BKA), German federal police, led to the seizure of infrastructure of a popular illegal darknet marketplace and its website.
In a statement on Thursday, German federal police said they seized the website and infrastructure of a major darknet marketplace ‘Nemesis’ known for drugs, illicit credit cards, and cybercrime services.
The Nemesis marketplace was founded in 2021 and supported more than 150,000 user accounts and 1,100 vendor profiles. German law enforcement authorities estimate that approximately 20% of the platform users were based in Germany.
Bundeskriminalamt (BKA) authorities said that “The range of goods available on the marketplace included narcotics, fraudulently obtained data and goods, as well as a selection of cybercrime services such as ransomware, phishing, or DDoS attacks.“
Authorities were able to confiscate criminal servers in Lithuania and Germany. The seized data will further assist investigators in identifying users of the platform. In addition, BKA officers also seized €94,000 ($102,000) worth of cryptocurrency assets, allegedly earned through illegal activity.
Dread Warnings
A day prior to the seizure notice, Francis was quick to warn his community and reach out to HugBunt3r as he made his escape. Francis left the following PGP Signed message.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Hello,
I'm Francis
Nemesis market got seized
Please ask vendors and buyers to clean their houses
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEg45eHfQwAhARnT/c+r7dqC6htMUFAmX7U+kACgkQ+r7dqC6h tMVxRw/+NJVLvHLFzIvBSkGwRt455KbBMan5c99D+dU9a4pbp76cPzA4zWCwtgUi SwN6bi8Z2PQStNWC/4M0Eld+FVhowRF1gIEvMSohHr+sLDVTusVi0ijHaDKj3ES/ Ho7v6TKhnb8aYGWh16XuoWKGDN9OH9MZsCXwE4QTMJhZJV4QC45aXAZSDph3zYhl TvKyCsI1cz5VSo9qWMJiZzzBglVxAjOtPLhpcN4d0MN4OE3dJ+tqaRvZ11I3Zy24 Ux4SCg1qI3jzRPKnHnX8HtcZvj92PiA2C2F/eRQqKcvEC+NPrY/tsWF+hA30eReN r7blgKNQqE/hZxrYDI1xwtrFycCAsKIXUi7Rwy2HxrP/PZhyn5rsj8xAWdCdpa0A Dth0vl2ACo/+l6xGBo18WN0GupQBqD9u80Zl83xyZ4HXbotttrjIIiv7PqviswE1 U5xTC3SvRNX+ZUNfXM5gqlJvjk7R8UmmXogJDlLi5w1aGN+WJE/9cgTtbh1nxMrr Rk9M81bG8x5j7jGWKveTBKS7+JBGH++mdk2gtUEL311Ew1OZSCLmuejgpxlRY8bx 4ACn17HXhE+N3dm4kt11eFL0WqNjua700LYpna7LPOmIAbjBbtPiXmM2InP7KZYj 5d7kPWABupbtUAjoA0MKlqVbmxQleYyD6OFXD52IVGQJDHJt1fA= =JdUh
-----END PGP SIGNATURE-----
HugBunt3r left a notice with a warning claiming
“While it isn’t publicly confirmed, I’d like to state I am confident that Nemesis Market was in fact seized. I agreed the post yesterday from the Admin Francis was strange, especially his follow up details or lack of.
It was unclear how he could know specifically that it was Lithuanian Law Enforcement, but this can usually be explained by hosting companies providing some sort of tip off through an email regarding a LE request for information. If there isn’t a gag order equivelant in place, this is actually quite common.
He was also very confident of not being identified and that he was in an “untouchable” location, before removing his posts and sending me a message to state his situation has changed and he is now “on the run”.
As always, vendors and buyers take whatever precautions you think you may need from the fallout of a market seizure.Prior to his post he had sent me this signed message I can share for clarity, which checks out as his PGP, I didn’t save his post yesterday and there is no way to recover it once he removed it.
What We Know About the Incident
The seizure of the darknet website follows a year-and-a-half- long investigation international into its operations. German federal police cooperated in this investigation with the FBI, the U.S. Drug Enforcement Administration, and Internal Revenue Service Criminal Investigation.
BKA authorities announced that the investigation into the darknet marketplace began in October 2022. During the investigation authorities discovered the marketplace’s infrastructure in Germany and Lithuania. The successful investigation resulted in the seizure of the darknet marketplace’s website and criminal servers.
On Thursday morning, visitors of the Nemesis darknet marketplace were greeted with a red banner announcing a website seizure. Police authorities placed an animated spaceship at the bottom of the banner, reminiscent of a video game called Nemesis.
The spaceship animation crashes into Nemesis’s logo and subsequently disappears from the screen, leaving a QR code with a link directed to the website for the German federal police, or BKA.
Despite the break in the investigation, BKA has yet to release any informatin mentioning the arrest of server administrators or any of the marketplaces core staff. The U.S. Department of Justice said, “The investigation to bring to justice the administrators of and vendors on Nemesis Market continues.” The DOJ further stated that investigations against both users and sellers of the platform are ongoing.
In a press release, BKA authorities said that the shutdown of Nemesis and the prosecution of its operators “are a further blow to underground economy actors operating on the dark web.” Authorities also stated that the seizure demonstrates the effectiveness of an international law enforcement operation in the digital space.
In December 2023, the BKA and ZIT were successful in capturing another major darknet marketplace known as the ‘Kingdom Market.’ The seizure resulted in the arrest of one the marketplaces administrators in the United States.
In recent weeks, Düsseldorf Police in Germany seized ‘Crimemarket.’ The darknet site was a popular German-speaking marketplace offering the sale of drugs, and cybercrime services. The platform boasted of 180,000 users and six people were arrested in the seizure, including the head operator.
Cybercriminal experts believe that operators of Nemesis marketplace are more than likely to resume their operations under a new website domain.
