After the recent closure of the hacker forum BreachForums (aka Breached), the ARES hack group is gaining popularity among criminals, selling databases stolen from companies and government agencies. Thus, the ARES Leaks platform, hosted on the regular internet, offers access to data leaks from 65 countries, including the United States, France, Spain, Australia, and Italy.
ARES was first spotted by cybersecurity experts on Telegram at the end of 2021, when it was linked to the RansomHouse ransomware, KelvinSecurity data breach platform, and Adrastea, an access-selling group. Analysts at Cyfirma write that ARES operates like a cartel and actively seeks contacts with other criminal groups.
The mentioned ARES Leaks platform leaks all types of information, from phone numbers, emails, customer details, B2B databases, and social security numbers, to Forex data and government leaks. The group willingly accepts payments in cryptocurrency from anyone who wants to access data or purchase one of the available services, including exploitation of vulnerabilities, penetration testing, malware development, and DDoS attacks.
According to Cyfirma, activity on ARES Leaks skyrocketed immediately after BreachForums closed. Currently, ARES operates a number of private and VIP channels, thus selling the most valuable data of well-known organizations. Analysts believe that ARES sees the closure of Breached as an opportunity to accelerate its growth and strengthen its market position.
In addition, ARES has recently begun making efforts to gain access and databases related to the military and is now actively advertising its interests on various platforms for hackers.
Another possible successor to BreachForums, Bleeping Computer calls the LeakBase forum, launched in early 2023 and also a project that supports ARES. LeakBase is also hosted on the clearnet and is free to join. The forum offers free databases, a platform for the sale of leaks, exploits, and services, as well as its own escrow system.
In addition, the forum has separate sections for programming, hacking tips, tutorials, social engineering, cryptography, anonymity, OpSec tutorials, and discussions.
Journalists conclude that while LeakBase is far from the scale of Breached, interest in it seems to be growing, and soon the site may become an important center for hackers selling information and services.