RaidForums, used by Lapsus$, Babuk, and other extortion gangs, is seized in a US-led international operation; Europol says the hacking forum had 500K+ users
a marketplace for #cybercriminals to buy and sell hacked data—and unsealed criminal charges against its founder and administrator, Diogo Santos Coelho of Portugal. #CyberIsATeamSport @FBIWFO https://www.justice.gov/... https://twitter.com/... Catalin Cimpanu / @campuscodi : Breaking: US DOJ confirms it seized RaidForum and detained its administrator, Diogo Santos Coelho, 21, of Portugal https://www.justice.gov/... https://twitter.com/... Joe Tidy / @joetidy :
Context & Ripple Effects
RaidForums functioned as a large exchange for hacked data, linking its more than 500,000 users with extortion groups including Lapsus$ and Babuk. The seizure pairs removal of that marketplace with DOJ charges against its founder, Diogo Santos Coelho.
The case is an early example of a recurring enforcement focus on cybercrime forums: later coverage records the BreachForums domain seizure, the Cracked and Nulled takedown, and the multinational shutdown of LeakBase.
First-order effects
- RaidForums users and the extortion groups that used it lose a prominent venue for buying and selling hacked data, while Coelho faces the unsealed DOJ case.
- US-led authorities and Europol convert a forum seizure into an identifiable-operator case rather than limiting the action to the site itself.
Second-order effects
- Data sellers and buyers formerly using RaidForums must shift their activity to other channels, concentrating attention on replacement forums that host stolen corporate data.
- The action gives law enforcement a model later applied to BreachForums, Cracked, Nulled, and LeakBase: target both public-facing domains and the people or infrastructure behind them.
Third-order effects
- Repeated cross-border forum takedowns point to cybercrime-market enforcement becoming a sustained campaign against the venues that connect data thieves, extortion groups, and buyers.
- If that pattern persists, forum operators face greater pressure to reduce their visible infrastructure and user bases may fragment across smaller marketplaces rather than depend on a single large site.
The trend: International law enforcement is increasingly targeting cybercrime forums as market infrastructure, combining domain seizures, infrastructure seizures, and cases against alleged operators.