#### [Security](/security/)**1** Gilmore Girls fans nabbed as Eurocops dismantle two major cybercrime forums===========================================================================**1** Nulled and Cracked had a Lorelai-cal rise – until Operation Talent stepped in—————————————————————————–[Connor Jones](/Author/Connor-Jones ‘Read more by this author’) Sun 2 Feb 2025 // 13:19 UTC [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums) [](https://twitter.com/intent/tweet?text=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&summary=Nulled%20and%20Cracked%20had%20a%20Lorelai-cal%20rise%20-%20until%20Operation%20Talent%20stepped%20in) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) Law enforcement officers across Europe assembled again to collectively disrupt major facilitators of cybercrime, with at least one of those cuffed apparently a fan of the dramedy series *The Gilmore Girls*.Two crime forums, Cracked and Nulled, were pulled offline.Together, the platforms amassed more than 9 million users and were often budding e-miscreants’ first foray into pursuing a life of cybercrime. Similar to BreachForums, which was [briefly taken down](https://www.theregister.com/2024/05/28/breachforums_back_online/) by law enforcement last year, Cracked and Nulled offered users a platform to discuss all things devious and a marketplace to sell their tools and ill-gotten wares. The collective takedown action was led by German authorities in a campaign dubbed Operation Talent and took place between January 28-30.It led to two arrests following the search of seven properties. Law enforcement seized 17 servers, 12 domains, 50 devices, and around €300,000 ($311,279) worth of cash and cryptocurrency tokens. Given that Cracked and Nulled generated millions in revenue, the amount seized is just a fraction – but still a notable disruption to their operations. Lucas Sohn, a 29-year-old Argentine, was the only named suspect. A video released by Europol showed Sohn, who resides in Spain, being arrested and his devices combed through by the Guardia Civil. The video also showed the arrest of a second, unnamed individual.It’s not known whether the pair were complicit in running the services taken down by the police, although the video, which showed glimpses of their living quarters, showed two desks situated next to each other in a room decorated with various merchandise such as Pop figures, anime art, and TV show posters including one depicting the fictional town of Stars Hollow where the *Gilmore Girls* series is set.According to the US Justice Department, Sohn is being linked to the administration of Nulled — a platform used to sell login credentials, stolen identity documents, and various tools used for cybercrime and fraud. The platform has [been in operation since 2016](https://www.theregister.com/2016/05/17/dark_web_hacking_forum_hacked/), has 5 million registered users, and is estimated to generate $1 million in annual revenue.’According to the complaint, Sohn was an active administrator of Nulled and performed escrow functions on the website,’ [said](https://www.justice.gov/opa/pr/cracked-and-nulled-marketplaces-disrupted-international-cyber-operation) the Justice Department.’Nulled’s customers would use Sohn’s services to complete transactions involving stolen credentials and other information.’Sohn faces three charges in the US related to conspiracy to traffic in [passwords](https://www.theregister.com/2024/11/17/passkeys_passwords/), access device fraud, and identity fraud, which carry maximum possible sentences of five, ten, and 15 years respectively.The Justice Department said Cracked had been on the scene since 2018 and raked in $4 million in the process. Its primary offering was a marketplace that offered access to stolen credentials, hacking tools, and servers to host malware and stolen data.It added that around 17 million people from the US were victimized by the activity that took place on Cracked, citing a specific case from New York where a woman was cyber-stalked and sextorted.The alleged criminal behind this campaign used a product advertised on Cracked that purportedly offered access to ‘billions of leaked websites,’ allowing users to search for stolen login credentials, including the New York woman’s.Eight of Cracked’s domains were seized and in doing so, investigators also found details of the site’s payment processor, Sellix, and the StarkRDP bulletproof hosting provider, both of which were scuppered.No named individual was arrested in connection to Cracked.* [BreachForums returns just weeks after FBI-led takedown](https://www.theregister.com/2024/05/28/breachforums_back_online/)* [Will passkeys ever replace passwords? Can they?](https://www.theregister.com/2024/11/17/passkeys_passwords/)* [American cops are using AI to draft police reports, and the ACLU isn’t happy](https://www.theregister.com/2024/12/12/aclu_ai_police_report/)* [Cybercrooks crafting solo careers in wake of ransomware takedowns](https://www.theregister.com/2024/07/22/europol_says_ransomware_takedowns_make/)### Saim Raza downMeanwhile, in a separate crackdown, the US and Dutch Politie jointly announced the disruption of a Pakistan-based fraud network.The network was comprised of websites devoted to selling products like phishing kits, which were later used to carry out [Business Email Compromise](https://www.theregister.com/2024/03/19/crypto_scams_cost/) (BEC) schemes — the most economically damaging cybercrime in the US, the FBI reckons.Run by a group known as Saim Raza, aka HeartSender, a total of 39 domains and their associated servers were seized by the US and Netherlands.Authorities didn’t specify victim numbers, only that ‘numerous’ US-based cases resulted in over $3 million in losses.’The seizure of these domains is intended to disrupt the ongoing activity of these groups and stop the proliferation of these tools within the cybercriminal community,’ the Justice Department [said](https://www.justice.gov/opa/pr/justice-department-announces-seizure-cybercrime-websites-selling-hacking-tools-transnational). ® [Whitepaper: Top 5 Tips For Navigating Your SASE Journey](https://go.theregister.com/tl/2386/-14369/top-5-tips-for-navigating-your-sase-journey?td=wptl2386bt) Share [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums) [](https://twitter.com/intent/tweet?text=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&summary=Nulled%20and%20Cracked%20had%20a%20Lorelai-cal%20rise%20-%20until%20Operation%20Talent%20stepped%20in) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) #### More about* [Cybercrime](/Tag/Cybercrime/)* [Europe](/Tag/Europe/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/) More like these × ### More about* [Cybercrime](/Tag/Cybercrime/)* [Europe](/Tag/Europe/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/) ### Narrower topics* [Armenia](/Tag/Armenia/)* [Austria](/Tag/Austria/)* [Azerbaijan](/Tag/Azerbaijan/)* [Belarus](/Tag/Belarus/)* [Belgium](/Tag/Belgium/)* [Bulgaria](/Tag/Bulgaria/)* [Croatia](/Tag/Croatia/)* [Cyprus](/Tag/Cyprus/)* [Czech Republic](/Tag/Czech%20Republic/)* [Denmark](/Tag/Denmark/)* [Estonia](/Tag/Estonia/)* [FBI](/Tag/FBI/)* [Finland](/Tag/Finland/)* [France](/Tag/France/)* [Georgia](/Tag/Georgia/)* [Germany](/Tag/Germany/)* [Greece](/Tag/Greece/)* [Hungary](/Tag/Hungary/)* [Iceland](/Tag/Iceland/)* [Ireland](/Tag/Ireland/)* [Italy](/Tag/Italy/)* [Kazakhstan](/Tag/Kazakhstan/)* [Latvia](/Tag/Latvia/)* [Liechtenstein](/Tag/Liechtenstein/)* [Lithuania](/Tag/Lithuania/)* [Luxembourg](/Tag/Luxembourg/)* [Malta](/Tag/Malta/)* [Monaco](/Tag/Monaco/)* [Montenegro](/Tag/Montenegro/)* [NCSC](/Tag/NCSC/)* [Netherlands](/Tag/Netherlands/)* [Norway](/Tag/Norway/)* [Poland](/Tag/Poland/)* [Portugal](/Tag/Portugal/)* [Romania](/Tag/Romania/)* [Russia](/Tag/Russia/)* [San Marino](/Tag/San%20Marino/)* [Serbia](/Tag/Serbia/)* [Slovakia](/Tag/Slovakia/)* [Slovenia](/Tag/Slovenia/)* [Spain](/Tag/Spain/)* [Sweden](/Tag/Sweden/)* [Switzerland](/Tag/Switzerland/)* [Turkey](/Tag/Turkey/)* [Ukraine](/Tag/Ukraine/)* [United Kingdom](/Tag/United%20Kingdom/) ### Broader topics* [Continent](/Tag/Continent/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/) #### More aboutShare [](https://www.reddit.com/submit?url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dreddit&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums) [](https://twitter.com/intent/tweet?text=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dtwitter&via=theregister) [](https://www.facebook.com/dialog/feed?app_id=1404095453459035&display=popup&link=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dfacebook) [](https://www.linkedin.com/shareArticle?mini=true&url=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dlinkedin&title=Gilmore%20Girls%20fans%20nabbed%20as%20Eurocops%20dismantle%20two%20major%20cybercrime%20forums&summary=Nulled%20and%20Cracked%20had%20a%20Lorelai-cal%20rise%20-%20until%20Operation%20Talent%20stepped%20in) [](https://api.whatsapp.com/send?text=https://www.theregister.com/2025/02/02/eurocops_takedown_cybercrime/%3futm_medium%3dshare%26utm_content%3darticle%26utm_source%3dwhatsapp) **1** COMMENTS #### More about* [Cybercrime](/Tag/Cybercrime/)* [Europe](/Tag/Europe/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/) More like these × ### More about* [Cybercrime](/Tag/Cybercrime/)* [Europe](/Tag/Europe/)* [United States Department of Justice](/Tag/United%20States%20Department%20of%20Justice/) ### Narrower topics* [Armenia](/Tag/Armenia/)* [Austria](/Tag/Austria/)* [Azerbaijan](/Tag/Azerbaijan/)* [Belarus](/Tag/Belarus/)* [Belgium](/Tag/Belgium/)* [Bulgaria](/Tag/Bulgaria/)* [Croatia](/Tag/Croatia/)* [Cyprus](/Tag/Cyprus/)* [Czech Republic](/Tag/Czech%20Republic/)* [Denmark](/Tag/Denmark/)* [Estonia](/Tag/Estonia/)* [FBI](/Tag/FBI/)* [Finland](/Tag/Finland/)* [France](/Tag/France/)* [Georgia](/Tag/Georgia/)* [Germany](/Tag/Germany/)* [Greece](/Tag/Greece/)* [Hungary](/Tag/Hungary/)* [Iceland](/Tag/Iceland/)* [Ireland](/Tag/Ireland/)* [Italy](/Tag/Italy/)* [Kazakhstan](/Tag/Kazakhstan/)* [Latvia](/Tag/Latvia/)* [Liechtenstein](/Tag/Liechtenstein/)* [Lithuania](/Tag/Lithuania/)* [Luxembourg](/Tag/Luxembourg/)* [Malta](/Tag/Malta/)* [Monaco](/Tag/Monaco/)* [Montenegro](/Tag/Montenegro/)* [NCSC](/Tag/NCSC/)* [Netherlands](/Tag/Netherlands/)* [Norway](/Tag/Norway/)* [Poland](/Tag/Poland/)* [Portugal](/Tag/Portugal/)* [Romania](/Tag/Romania/)* [Russia](/Tag/Russia/)* [San Marino](/Tag/San%20Marino/)* [Serbia](/Tag/Serbia/)* [Slovakia](/Tag/Slovakia/)* [Slovenia](/Tag/Slovenia/)* [Spain](/Tag/Spain/)* [Sweden](/Tag/Sweden/)* [Switzerland](/Tag/Switzerland/)* [Turkey](/Tag/Turkey/)* [Ukraine](/Tag/Ukraine/)* [United Kingdom](/Tag/United%20Kingdom/) ### Broader topics* [Continent](/Tag/Continent/)* [Federal government of the United States](/Tag/Federal%20government%20of%20the%20United%20States/)* [Security](/Tag/Security/) #### TIP US OFF[Send us news](https://www.theregister.com/Profile/contact/)[#### North Korean dev who renamed himself ‘Bane’ accused of IT worker fraud caper5 indicted as FBI warns North Korea dials up aggression, plus Russian devs allegedly get in on the actCyber-crime9 days -| 2](/2025/01/24/north_korean_devs_and_their/?td=keepreading) [#### HPE probes IntelBroker’s bold data theft boastsIncident response protocols engaged following claims of source code burglaryCyber-crime12 days -|](/2025/01/21/hpe_intelbroker_claims/?td=keepreading) [#### Microsoft joins CISPE, the Euro cloud crew that tried to curb its licensingExclusive From fighters to friends in six months, despite AWS voting against itPaaS + IaaS12 days -| 9](/2025/01/21/microsoft_joins_cispe/?td=keepreading) [#### Fortify your dataHow cyber resilient storage hardware can defeat ransomwareSponsored Feature](/2024/11/26/fortify_your_data/?td=keepreading) [#### Welsh woman fined for flatulence-fueled cyber harassmentCourt said her approach to child access dispute with partner’s ex really stinksBootnotes2 days -| 90](/2025/01/31/wales_flatulence_harassment/?td=keepreading) [#### Another banner year for ransomware gangs despite takedowns by the copsAnd it doesn’t take a crystal ball to predict the futureCyber-crime2 days -| 5](/2025/01/31/banner_year_for_ransomware_gangs/?td=keepreading) [#### Why is my Mitel phone DDoSing strangers? Oh, it was roped into a new Mirai botnetAnd now you won’t stop calling me, I’m kinda busyCSO4 days -| 4](/2025/01/29/ddos_attacks_aquabot_mitel/?td=keepreading) [#### ‘Bro delete the chat’: Feel the panic shortly before cops bust major online fraud ringMastermind begs colluders to bury evidence later used to imprison himCyber-crime4 days -| 21](/2025/01/29/otp_agency_convicted/?td=keepreading) [#### Baguette bandits strike again with ransomware and a side of mockeryBig-game hunting to the extremeCyber-crime5 days -| 6](/2025/01/28/baguettes_bandits_strike_again/?td=keepreading) [#### DARPA asking for ideas on automating money laundering detectionWith all the AI hype swirling around, you’d think someone would’ve cracked this one alreadySoftware5 days -| 21](/2025/01/28/darpa_auto_money_laundering_detection/?td=keepreading) [#### Someone is slipping a hidden backdoor into Juniper routers across the globe, activated by a magic packetWho could be so interested in chips, manufacturing, and more, in the US, UK, Europe, Russia…Networks8 days -| 76](/2025/01/25/mysterious_backdoor_juniper_routers/?td=keepreading) [#### UK telco TalkTalk confirms probe into alleged data grab underwaySpinner says crim’s claims ‘very significantly overstated’Security8 days -| 33](/2025/01/25/uk_telco_talktalk_confirms_investigation/?td=keepreading)
Related Tags:
NAICS: 52 – Finance And Insurance
NAICS: 518 – Computing Infrastructure Providers
Data Processing
Web Hosting
Related Services
NAICS: 92 – Public Administration
NAICS: 922 – Justice
Public Order
Safety Activities
NAICS: 516 – Broadcasting And Content Providers
NAICS: 522 – Credit Intermediation And Related Activities
NAICS: 51 – Information
Blog: The Register Security
Phishing
Associated Indicators: