ZeroFox Intelligence Flash Report - BreachForums and Notorious Actors Announce Re-emergence

ZeroFox Intelligence Flash Report - BreachForums and Notorious Actors Announce Re-emergence

Product Serial: F-2025-06-05a

TLP:CLEAR

In this Flash report, ZeroFox researchers report on recent announcements made by actors IntelBroker and ShinyHunter, claiming that the popular deep web hacking forum BreachForums has been relaunched.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On June 3, 2025, an actor using the alias “darked321” posted in the deep web forum DarkForums claiming its counterpart-BreachForums, another popular deep web hacking forum, has been relaunched.
• Darked321’s DarkForums post quoted a longer message from actor “ShinyHunters”, who provides an alleged explanation as to the status of the original BreachForums domain, and plans for the new one. ZeroFox also observed activity from “IntelBroker”.
• Given the presence of ShinyHunters and IntelBroker, there is a likely chance that breach-forums[.]st represents a relaunch effort led by actors in possession of digital infrastructure associated with the original domain.
• There is a very likely chance that breach-forums[.]st will quickly gain traction and restore functionality, though it is also likely that many users will remain active within peer domain DarkForums-where many actors migrated upon BreachForum’s disruption.