The U.S. Department of Justice recently announced the conclusion of its cross-border investigation into the dark web black market xDedic, charging 19 cybercriminals suspected of participating in the operation and use of the xDedic dark web black market. With the support of Europol and Eurojust, law enforcement agencies from the United States, Belgium, Ukraine, Germany and the Netherlands conducted joint law enforcement operations and successfully seized xDedic's domain name and infrastructure in January 2019.
By the time it was seized, the total amount of fraudulent activities facilitated by xDedic exceeded $68 million. The black market mainly provided various victim information, including personal information, data from U.S. local governments, state governments and even the U.S. federal government, and sold data from hospitals, universities, transportation bureaus, accounting firms, law firms, and nursing homes. This data is further used to conduct criminal activities including fraud, money laundering, phishing, etc.
The administrators of xDedic naturally knew that the consequences of being caught would be serious, so from the beginning they tried to use anonymous cryptocurrency to purchase servers and domain names, and all transactions in the entire black market were completed through cryptocurrency.
Investigation shows that the server certificates sold by xDedic involve 700,000 servers, at least 150,000 of which are located in the United States. These servers are used to further compromise a business or institution to obtain more information.
After conducting investigations, law enforcement agencies gradually found the cybercriminal gang behind xDedic (including administrators, sellers and buyers). A total of 19 people have been arrested so far, 12 of whom have been sentenced, 5 are awaiting sentencing, and 2 are awaiting extradition from the UK to the United States for trial.
Two administrators of xDedic, Salvadoran Alexandru Habasescu and Ukrainian Pavlo Kharmanskyi, were arrested in Spain and Miami in the United States in 2022. They were sentenced to 41 months and 30 months in prison respectively.
The number one seller on xDedic is a Russian citizen named Dariy Pankov, who earned $350,000 by selling credentials for 35,000 servers around the world on xDedic.
The number one buyer on xDedic is a Nigerian citizen named Allen Levinson. His main interest is to purchase access and data to a U.S. CPA firm, and then use the data items to submit hundreds of false tax returns to the U.S. government, and then apply for more than $60 million in tax refunds from the U.S. government.
I have to say that this Nigerian buyer really follows the tradition. The various scam emails you receive that I am a certain prince and have a certain amount of funds that need to be unfrozen and asking you to pay for help are mainly caused by Nigerian fraud gangs.
In the end, Allen Levinson was the longest-term prison sentence among the 12 criminals who have been sentenced so far. He needs to serve 78 months in the United States, or 6 and a half years.