Cisco's Talos unit finds 74 groups on Facebook, with around 385,000 members in total, whose members buy and sell hacking tools, stolen card info, more
This blog was written by Jon Munshaw and Jaeson Schultz. — Cisco Talos is continually working to ensure that our threat intelligence …
Context & Ripple Effects
A year after Facebook deleted almost 120 private cybercrime groups with roughly 300K members following a tip from Brian Krebs, Cisco Talos documents that the marketplace has reconstituted itself: 74 groups, around 385,000 members in total, trading hacking tools and stolen card information. The membership total exceeding the earlier purge's footprint suggests deletion alone did not dismantle demand.
The report also fits Talos's broader pattern of publishing research that pressures named targets — from its later work tracing Lazarus Group exploitation of Log4j in VMware Horizon servers at energy providers to vendor-specific disclosures — making this as much an enforcement referral to Facebook as a threat-intelligence product.
First-order effects
- Facebook comes under immediate pressure to repeat its 2018 playbook and remove the 74 groups Talos identified, while the tool vendors and card-data sellers inside them lose their buyer pool if it does.
- Cisco Talos converts routine intelligence gathering into public leverage against a platform giant, reinforcing its role as the researcher whose reports trigger takedown decisions.
Second-order effects
- Sellers of stolen credentials and card data — the supply side behind figures like [[a:870433|rival hackers Tessa88 and Peace claiming millions of unsold hacked credentials from Facebook and Instagram]] — face recurring channel loss on major social platforms and incentive to fragment across smaller, less-moderated venues.
- Other platforms hosting similar groups can expect comparable researcher scrutiny, since Talos demonstrated the report-then-purge cycle works and generates coverage.
Third-order effects
- If the 2018 purge and this 2019 census mark the pattern, cybercrime marketplace disruption becomes a standing function of platform trust-and-safety teams rather than a one-off response to a journalist's tip.
- Security vendors gain a durable playbook — document the marketplace, publish, force the platform's hand — shifting some policing of criminal economies from law enforcement to private threat-intelligence firms and the platforms themselves.
The trend: Cybercrime marketplaces on mainstream social platforms are settling into a regrow-and-purge cycle driven by security vendors' disclosures rather than one-time cleanups.