“Black Hand” Darknet Forum Seized by French Authorities
Customs in France announced the end of an operation that resulted in the takedown of a French darknet forum known as the “Black Hand.” According to the announcement from the Minister of Public Accounts, the forum—also described as a market—facilitated the trade of drugs, fake identification documents, stole data and other items or software often found on darknet markets.
French officials announced the takedown on June 16, 2018. Along with the seizure of the market, the National Directorate of Intelligence and Customs Investigations (DNRED) led a two-day operation that brought down four forum members and into custody. One of the arrested individuals, according to the announcement, allegedly worked as the site administrator. The additional suspects’ roles were not revealed to the public.
The investigation involved “more than 40 DNRED agents, customs handlers and several technical experts. It took place simultaneously in several cities of France.” The actual arrests occurred on June 12 in a span of 48 hours. The authorities arrested the four previously mentioned suspects and seized evidence, servers, and money. One of the suspects had counterfeit or forged identity documents in their possession. The police seized 4,000 euros and more than 20,000 euros from assorted cryptocurrency wallets.
This investigation was “the first of its kind in France,” the Minister of Public Accounts, Gerald Darmanin, said during an announcement. Authorities also managed to seize the marketplace’s servers during the raids. According to the information revealed through in personal release, the site had more than 3,000 registered users or accounts (some users likely had more than a single account).
Membership on the site was limited to individuals known and vouched for by another member of the forum. The site, at some point, required a membership fee from new users, as well. Although the number of users hardly compares to some of the larger darknet markets that law enforcement ended in 2017, French authorities said the users confirmed “the very active character of this French forum.”
Authorities also obtained access to the sites live servers and user database. They are currently analyzing the data from the seized servers and computers. Investigators either caught the administrator while he was logged into his device or convinced the suspect to hand his passwords over to the authorities. Alternatively, the admin could have failed to adequately secure the server or encrypt his data.
An investigation into the site’s remaining users has been launched and the Central Office for Combating Information and Communication Technologies Crime (OCLCTIC) has taken control of the operation.