Nemesis darknet marketplace raided in Germany-led operation

German police said they seized the infrastructure of the popular illegal darknet marketplace known as Nemesis and took its website down.

Visitors to the cybercrime website were greeted on Thursday with a red banner announcing the takeover. At the bottom, the police placed an animated spaceship reminiscent of a 1990s video game called Nemesis.

The spaceship blows up the marketplace logo and then vanishes from the screen, leaving behind a QR code that links to the website for the Bundeskriminalamt (BKA), or German federal police.

🚨BREAKING🚨Nemesis Market, a top 5 darknet market, has been seized. #Nemesis #DarkWebInformer #DarkWeb #Cybersecurity #Cyberattack #Cybercrime #Infosec #CTI #Darknet pic.twitter.com/P22VDSo79v

— Dark Web Informer (@DarkWebInformer) March 21, 2024

The shutdown of Nemesis and the prosecution of its operators “are a further blow to underground economy actors operating on the dark web and demonstrate the effectiveness of international law enforcement in the digital space,” the BKA said in a press release.

German law enforcement hasn't responded to Recorded Future News' request for comment about whether the website's administrators were arrested. According to local media outlet Der Spiegel, the operators have not been identified. 

The German agency said it teamed up with law enforcement from the U.S. and Lithuania to investigate the Nemesis operation. During the year-and-a-half-long investigation, they discovered marketplace infrastructure in Germany and Lithuania, the BKA said.

"The investigation to bring to justice the administrators of and vendors on Nemesis Market continues," a spokesperson for the U.S. Department of Justice told Recorded Future News. 

Law enforcement confiscated criminal servers and seized data that could help to identify users of the platform, the BKA said. They also obtained €94,000 ($102,000) worth of cryptocurrency assets, allegedly earned through illegal activity. The website operators are suspected of drug trafficking and running a criminal trading platform.

Nemesis was founded in 2021 and has been growing rapidly since then, according to the BKA. More than 150,000 users and over 1,100 sellers were registered on the platform. The police estimated that nearly 20% of these sellers are based in Germany.

Nemesis sold all kinds of illegal goods — drugs, compromised data and  cybercrime services such as ransomware and tools to conduct phishing or DDoS attacks.

Past operations against cybercrime markets suggest that even though Nemesis's infrastructure was shut down, the criminals might retain the ability to restart their operations somewhere else.

For example, after law enforcement took down the website of the notorious ransomware gang LockBit, the group attempted to relaunch its cyber extortion operation. LockbitSupp, the group’s administrator, opened a new website and claimed that the takedown didn’t affect his business but rather gave him additional publicity.

“What doesn't kill you makes you stronger,” he said in an interview with Recorded Future News’ Click Here podcast.

Jonathan Greig contributed to this story.

Editor's Note: Updated 1:10 p.m. Eastern U.S. time with response from DOJ.