Three suspects arrested in Ukraine as FBI and several EU countries seize the domain and servers of xDedic, an online marketplace for access to hacked servers
Catalin Cimpanu / ZDNet : Tweets: @flashpointintel and @garwarner Tweets: Flashpoint / @flashpointintel : “xDedic provided access to more than 85,000 hacked servers in its heyday,” writes @ZDNet's @campuscodi, citing Flashpoint research: http://okt.to/qfRhuB @garwarner : @Europol and @CyberpoliceUA, with @fbi and Belgium have shuttered #xDedic a service selling access to 85,000+ hacked servers for as little as $6 each. http://www.zdnet.com/... @campuscodi has the best coverage. http://twitter.com/...
Context & Ripple Effects
The xDedic seizure closes a marketplace that Flashpoint research says brokered access to more than 85,000 hacked servers at prices as low as $6 each — a turnkey supply chain for intrusions rather than stolen data itself. The operation pairs the FBI, Europol and Belgian authorities with Ukraine's Cyberpolice, who arrested three suspects on their own soil.
It lands weeks after the FBI's seizure of 15 DDoS-for-hire domains, and the template holds across the years that follow: the DOJ's joint seizure of the SlilPP credential marketplace with Germany, the Netherlands and Romania, and eventually Europol's takedown of the Cracked and Nulled forums. Ukraine keeps recurring as both jurisdiction and source of arrests, from this case to the later detention of a credential seller by its Secret Service.
First-order effects
- Buyers who relied on xDedic for cheap pre-positioned server access lose their inventory overnight, forcing them to re-source footholds or build intrusions themselves.
- The three suspects arrested by Ukraine's Cyberpolice move from operating a marketplace to facing prosecution, and the site's domain and servers are now in law enforcement hands.
Second-order effects
- Sellers of compromised-server access migrate to surviving forums and encrypted channels, dispersing the trade and making future seizures depend on infiltrating communities rather than grabbing one domain.
- Rival underground marketplaces absorb displaced xDedic demand, tightening supply enough to push per-server access pricing up from the $6 floor the site advertised.
Third-order effects
- If the seizure pattern holds — DDoS-for-hire networks, then xDedic, then SlilPP, then Cracked and Nulled — cross-border domain-and-server seizures become the standard enforcement instrument against cybercrime infrastructure, with Ukraine cemented as an indispensable operational partner.
- Marketplace operators respond structurally, favoring distributed hosting, invite-only access and rapid rebranding, which shifts the cost curve of takedowns upward and pushes enforcement toward arresting administrators, as later Ukrainian actions show.
The trend: Law enforcement is industrializing cross-border seizures of cybercrime marketplaces — moving from single-site takedowns to recurring multi-country operations that pair US agencies with European and Ukrainian police.