An international law enforcement operation has dismantled one of the largest cybercrime-as-a-service platforms on the dark web, resulting in 37 arrests across nine countries. The platform, known as “DarkForge,” provided subscribers with ready-made tools for launching distributed denial-of-service attacks, deploying ransomware, and conducting credential stuffing campaigns.
Operation Nightfall
The takedown, codenamed Operation Nightfall, was coordinated by Europol and the FBI with participation from law enforcement agencies in the United Kingdom, Germany, France, the Netherlands, Australia, Canada, Japan, and South Korea. Authorities seized servers in five countries and froze cryptocurrency wallets containing an estimated $14 million in illicit proceeds.
DarkForge had operated since 2023 and attracted more than 12,000 registered users, according to court documents unsealed this week. The platform offered a tiered subscription model, with basic DDoS attack capabilities available for as little as $50 per month and advanced ransomware deployment kits priced at $500.
Lowering the Barrier to Entry
What made DarkForge particularly dangerous was its user-friendly interface and customer support infrastructure. The platform provided tutorial videos, a help desk staffed by experienced hackers, and even a satisfaction guarantee for its attack services. This model dramatically lowered the technical barrier to entry for aspiring cybercriminals.
“DarkForge represented the industrialization of cybercrime,” said FBI Deputy Director Paul Abbate. “It allowed individuals with minimal technical skills to launch sophisticated attacks against businesses, governments, and individuals worldwide.”
The Arrests
Among those arrested were three alleged administrators of the platform, including a 28-year-old software developer in Romania believed to be the primary architect of DarkForge’s infrastructure. The remaining suspects include resellers, power users, and individuals who allegedly provided money laundering services for the operation.
Europol confirmed that additional arrests are expected as investigators continue to analyze data recovered from the seized servers. The agency is also working to identify and notify victims of attacks launched through the platform.
Impact on the Cybercrime Ecosystem
While the takedown of DarkForge is a significant victory, cybersecurity experts caution that the cybercrime-as-a-service ecosystem is resilient. Competing platforms are likely to absorb displaced users, and new services will inevitably emerge to fill the gap.
Deterrence Through Enforcement
Nevertheless, law enforcement officials argue that operations like Nightfall serve a critical deterrent function. By demonstrating that dark web anonymity is not absolute and that international cooperation can reach across borders, these takedowns raise the perceived risk for cybercriminals.
“Every takedown disrupts criminal operations, erodes trust in underground markets, and sends a clear message that there are consequences,” said Europol Executive Director Catherine De Bolle.
The investigation remains ongoing, and authorities have encouraged anyone with information about DarkForge or related platforms to contact their national cybercrime reporting center.
