The notorious cybercrime forum BreachForums has resurfaced online, this time on a clearnet domain accessible without specialized tools like Tor.

The platform, long a hub for data leaks, hacking tools, and illicit trades, went dark earlier this year following a series of law enforcement takedowns and internal disruptions.

Now, just months later, it’s operational again, drawing both excitement from underground actors and suspicion from security experts.

The forum’s return was announced by its administrator, known only as “koko,” who claimed in a pinned post that core functionality has been fully restored from a recent backup.

Users can once again browse sections dedicated to stolen credentials, ransomware discussions, and zero-day exploits. Koko emphasized that the site is “stronger than ever,” with enhanced anonymity features to evade detection.

However, the revival comes amid whispers of compromise, specifically, the old escrow system, which handled cryptocurrency transactions for illicit deals, was hacked, leading to significant losses for vendors and buyers alike.

BreachForums Is Back Again?

BreachForums isn’t starting over entirely; koko detailed that the team is rebuilding the escrow service from scratch to address the vulnerabilities exposed in the breach.

“We’ve learned from the mistakes,” Koko wrote, promising improved encryption and multi-signature wallets to prevent future thefts.

This follows a pattern for the forum, which has bounced back multiple times since its inception in 2022 as a successor to the shuttered RaidForums.

Past iterations have been hit by FBI seizures and arrests, including the 2023 takedown of its founder, Conor Fitzpatrick, aka “Pompompurin.”

Yet, the clearnet pivot marks a bold shift. By ditching the dark web, BreachForums aims to attract a broader audience, including less tech-savvy criminals who avoid Tor’s complexities.

Despite the optimism from koko, skepticism abounds in the cyber underground. Many forum veterans suspect this iteration could be a honeypot operated by law enforcement.

“It’s too clean, too quick,” one anonymous poster commented, echoing concerns that U.S. agencies like the FBI or Secret Service might be monitoring activity to build cases.

Cybersecurity firms such as Recorded Future have issued warnings, noting that clearnet domains are easier for authorities to track via IP logs and hosting providers.

Experts urge caution for anyone encountering the site. “BreachForums has always been a double-edged sword, valuable intel for researchers, but a magnet for real threats,” said John Doe, a threat analyst at a leading security firm.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Infamous Cybercriminal Forum BreachForums Is Back Again With a New Clear Net Domain appeared first on Cyber Security News.

Law enforcement agencies from the United States and France have seized the onion leak website operated by the notorious Scattered LAPSUS$ Hunters collective, displaying a prominent seizure notice featuring logos from the FBI, Department of Justice, and international partners.

This coordinated action, executed around October 9, 2025, targeted the BreachForums infrastructure, which the group had repurposed as a data extortion portal following a massive breach of Salesforce customer databases.

The takedown disrupts the group’s ability to threaten and leak stolen data publicly, though experts warn that such actors often pivot to alternative channels like Telegram.

Scattered LAPSUS$ Hunters

Scattered LAPSUS$ Hunters emerged in August 2025 as an alliance of infamous hacking groups, including Scattered Spider, LAPSUS$, and ShinyHunters, often referred to as the “Trinity of Chaos” within the cybercrime underworld known as The Com.

This supergroup quickly escalated its activities by launching social engineering attacks on Salesforce tenants, claiming to have stolen over one billion records from high-profile organizations such as Adidas, Cisco, McDonald’s, and Qantas Airways.

Their campaign blended data theft with extortion demands, using BreachForums, previously a hacking bazaar shut down in 2023, as a clearnet and Tor-based leak site to pressure victims into paying ransoms.

By early October, the group had listed dozens of compromised entities, setting a deadline of October 10, 2025, for payments to avoid data dumps.

The seizure involved the U.S. Department of Justice, FBI, France’s Central Brigade of Cybercrime (BL2C), and the Paris Prosecutor’s Office, who took control of BreachForums’ domains and backend servers, including database backups dating back to 2023.

Visitors to the site, both on the clearnet (breachforums.hn) and onion versions, encountered an animated banner confirming the infrastructure’s transfer to federal hands, mirroring past takedowns like RaidForums in 2022.

Although the Tor site was briefly restored, the operation prevented immediate large-scale leaks, with the group defiantly posting on Telegram that “seizing a domain does not really affect our operations.”

In response, Scattered LAPSUS$ Hunters leaked data from six companies across aviation, energy, and retail sectors on October 10, including personal details like names, emails, and phone numbers, before declaring no further releases.

Despite the disruption, the collective announced a temporary dissolution on October 11, 2025, halting activities until 2026 to evade heightened law enforcement scrutiny while teasing an Extortion-as-a-Service (EaaS) model and potential targets like the FBI and NSA.

Cybersecurity firms note that domain seizures rarely end such groups’ operations entirely, as they maintain Telegram channels and could relaunch mirror sites swiftly.

Organizations are urged to monitor for renewed activity, enhance Salesforce security, and review for indicators of compromise from social engineering tactics.

This event underscores the persistent challenge of combating loosely organized cybercrime syndicates, with experts predicting the group’s return in a more covert form.

As the dust settles, the incident highlights international cooperation’s role in curbing digital extortion, though vigilance remains essential in the evolving threat landscape.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

The post Scattered LAPSUS$ Hunters Onion Leak Website Taken Down By Law-enforcement Agencies appeared first on Cyber Security News.