ZeroFox Intelligence Flash Report - First Potential BreachForums Successor Announced

Product Serial: F-2024-05-20a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on the planned launch of a new data leak forum, which could serve as a potential successor to the recently-disrupted BreachForums.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

On May 16, 2024, threat actor “USDoD” announced on X (formerly, Twitter) their intent to launch a new, open-source data breach forum named Breach Nation.
USDoD stated their intent for Breach Nation to serve as a successor to BreachForums, which was severely disrupted on May 15, 2024, by a law enforcement (LE) operation that seized the forum’s [.]st domain, a [.]onion domain, and a Telegram channel.
There is a roughly even chance that Breach Nation will become a popular tool for threat actors seeking to discuss techniques, tactics, and procedures (TTPs) related to data breach attacks, publicize results, and sell stolen information.
It is likely that, in the coming months, other BreachForums members, moderators, and staff will seek to capitalize upon its disruption by creating and advertising new forums.