Scholarlink

Objectives <p>Assess potential spillover effects Operation Cookie Monster (OCM), a law-enforcement takedown of an online market selling stolen account credentials, had on users and administrators of an untargeted hacker forum, a different platform type where similar goods are shared.</p> Methods <p>Treating OCM as a natural experiment, we used data from two sources: observations of forum advertisements and an extension of a prior field experiment. We analyzed changes in posting frequency by user rank, credential types, and administrator content removal before OCM to six months after.</p> Results <p>Activity declined among experienced non-paying users and most credential types, while increasing among paying users and posts advertising social media and cloud accounts. Administrator moderation intensified after OCM, becoming more selective and retroactive, before gradually declining.</p> Conclusions <p>OCM produced temporary diffusion of benefits alongside evidence of crime displacement. Enforcement actions can affect untargeted related platforms, but offender adaptation limits longer-term impact.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

The ripple effect of operation cookie monster: the impact of an illicit market takedown on an untargeted hacker forum

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月20日

查看全文
  • Danielle Stibbe,
  • Stijn Ruiter,
  • Asier Moneva

摘要

Objectives

Assess potential spillover effects Operation Cookie Monster (OCM), a law-enforcement takedown of an online market selling stolen account credentials, had on users and administrators of an untargeted hacker forum, a different platform type where similar goods are shared.

Methods

Treating OCM as a natural experiment, we used data from two sources: observations of forum advertisements and an extension of a prior field experiment. We analyzed changes in posting frequency by user rank, credential types, and administrator content removal before OCM to six months after.

Results

Activity declined among experienced non-paying users and most credential types, while increasing among paying users and posts advertising social media and cloud accounts. Administrator moderation intensified after OCM, becoming more selective and retroactive, before gradually declining.

Conclusions

OCM produced temporary diffusion of benefits alongside evidence of crime displacement. Enforcement actions can affect untargeted related platforms, but offender adaptation limits longer-term impact.