OFAC / Rogue Russian Credential Marketplace Sanctioned

Treasury's Office of Foreign Assets Control (OFAC) has designated Genesis Market, one of the world's largest illicit marketplaces, for its part in the theft and sale of device credentials and related sensitive information.

The move follows the Treasury's 2022 National Money Laundering Risk Assessment, which identified the risks associated with darknet markets, where criminals can profit from unauthorized access to victim computers by selling stolen data to other criminals for further exploitation.

Genesis Market is believed to operate from Russia and has both a clearnet (traditional internet) and a darknet presence, making it one of the most prominent brokers of stolen credentials and other sensitive information.

The marketplace identifies victim computer systems and gains unauthorized access to them, selling this access to cybercriminals for further exploitation. Its website compiles stolen victim data, including computer and mobile device identifiers, email addresses, usernames, passwords, and other credentials from malware-infected systems around the world, and packages it for sale.

As of February 1, 2023, there were approximately 460,000 packages listed for sale on Genesis Market, each representing a single, compromised victim computer or device. These packages contain stolen passwords and personal information for a variety of online accounts, including email, social media, and video streaming platforms, among others.

According to the OFAC, Genesis Market sells stolen credentials from leading U.S. and international companies and facilitates cybercrimes against them. In June 2021, a U.S. company was breached by hackers who stole sensitive data, including a software engine and source code. The hackers were able to access the U.S. company's system because of a cookie purchased from Genesis Market. The marketplace has also been used by cybercriminals to target U.S. government organizations.

In response to this threat, the OFAC has designated Genesis Market, thereby blocking all property and interests in property of the entity that are in the United States or in the possession or control of U.S. persons.

OFAC's regulations generally prohibit all dealings by U.S. persons or within the United States (including transactions transiting the United States) that involve any property or interests in property of a blocked or designated entity. Persons that engage in certain transactions with the entity designated today may themselves be exposed to sanctions.