Genesis Market — Ransomware Profile
Genesis Market was an invitation-only criminal marketplace that sold "bots" — bundles of credentials, session cookies and browser fingerprints harvested from infostealer-infected devices — together with a custom browser plugin that let buyers replay a victim's session and bypass multi-factor authentication. Sophos characterised it as an initial access broker rather than an attack group, noting that ransomware groups and affiliates were frequent customers; Genesis itself never deployed ransomware and ran no leak site. The FBI and the Dutch National Police seized its infrastructure on 4 April 2023 in Operation Cookie Monster, an action across 17 countries that produced 119 arrests, with roughly 460,000 compromised-device packages listed for sale as of 1 February 2023. The US Treasury designated the marketplace the following day, saying it "is believed to be located in Russia" — a hedged location claim that no vendor research corroborates and that no identified operator supports, so no country attribution is recorded here.Also tracked as
Genesis Marketplace, Genesis Store
Vendor research
- Popular Illicit Shop Genesis Market Seized by Law Enforcement Flashpoint
- Genesis Brings Polish to Stolen-Credential Marketplaces Sophos
- Genesis Market No Longer Feeds The Evil Cookie Monster Trellix Advanced Research Center
- Technical analysis of the Genesis Market DEFION Research Labs (formerly Computest Sector 7)
- Digital Doppelgangers Kaspersky