BreachForums will rise from the dead Thursday - or will it? Not if Dark Storm has its way

The infamous hacker marketplace BreachForums is set to rise from the dead – once again, according to a new community post directed at its hundreds of thousands of shadowy users, and an email sent directly to Cybernews. That is, unless the Dark Storm Team decides to interfere.

But, as Breached 4.0 tries to steady its sea legs, its new website address has already been hit by the same gang responsible for its latest demise.

Last week, the hacker-friendly BreachForums was randomly taken offline in a major cybercriminal dis claimed by the ever-so-busy hacktivist gang the Dark Storm Team.

The pro-Palestinian hacktivist group posted about the April 16th Breached takeover on its Telegram channel, claiming to have carried out the distributed denial-of-service (DDoS) attack “for fun.”

If the name sounds familiar, The Dark Storm Team is the same group believed responsible for last month’s massive outage of Elon Musk’s X.

Meanwhile, earlier Tuesday, Cybernews received a direct message from the new owner of the BreachForums reboot announcing its scheduled resurrection for this Thursday.

“Hello. The previous owner of BreachForums (Anastasia) has reinstated the forum!” they wrote in the email message sent via Proton, providing a link to its new home address and an official announcement.

The official statement was also posted on the BreachForums site. Dated April 22nd, it reads:

Dear Community, Update: (22-04-2025), We are happy to announce that we have finished the infrastructure and management of the forum. The forum will be restarted and accessible again at this address between 23-24.04.2025. See you! Thank you for your patience and continued support - [Owner] Anastasia

New Breached site hit already

But even as the Breached news was announced, Dark Storm wasted no time targeting the site with another DDoS attack, again posting about its handiwork on Telegram over the weekend.

Well, actually two posts – one showing proof of the successful attack with a check-host[.]net link – and the other a lewd cartoon depicting The Dark Storm Team (for the lack of a better word) ‘riding’ BreachForums.

It’s probably best not to try to further describe the cartoon, so we’ll just show it to you here.

The cartoon post appears to have been forwarded to Dark Storm by a Telegram channel of "Yemeni hackers + Russia hackers + Brazilian hackers" called "Team R70 'YE.'"

According to a profile listed on X, Team R70 claims to be a group of "many young Yemenis who work for the homeland and fight the enemy with advanced digital weapons." Although there is no known connection between the two gangs, both obviously identify as anti-West and anti-Israel.

Cybernews has reached out to Anastasia, the current owner of BreachForums for a comment on the latest attack and is wating for a respose at the time of this report. .

BreachForums has experienced its ups and downs since the March 2023 arrest of its former founder and top administrator, Pompompurin, aka 20-year-old Conor Brian Fitzpatrick from New York.

The site, first seized by the FBI during the arrest, was then resurrected in June by its second-in-command, Blaphomet, only to be taken down by the FBI again in May 2024. Since then, a third iteration of Breached was claimed by both Shiny Hunters and another notorious user on the forum, USDoD.

In January, fellow hacker forums Cracked and Nulled were also seized by the FBI, with Cracked resurrecting itself earlier this month.

Dark Storm keeps busy

This second attack on BreachForums within a week is just another notch in the belt for the hacker group, who in the past few weeks have claimed DDoS attacks on 4Chan, Target, and on Tuesday, four airports in Germany.

On March 12th, the Dark Storm digital army jumped on the anti-Trump and anti-Musk/DOGE bandwagon, taking down the X platform to "peacefully protest" the duo’s “blatant fascism and lack of humanity.”

The DDoS attacks on the Elon Musk-owned social messaging site, which flood a target’s servers with thousands of traffic requests (often using automated bots), came after a weekend of live protests at Tesla dealerships across the US.

Said to be a pro-Palestinian hacktivst group primarily focused on taking down Israeli infrastructure, the group has been boasting of its work on Telegram since 2023.

According to a cyber risk intelligence report by SecurityScorecard from 2023, the Persian-speaking group has not only targeted the Israeli government, local municipalities, and sensitive industries, but is also known for claiming DDoS attacks on John F. Kennedy Airport in New York and Los Angeles Airport (LAX), as well as Snapchat.

Dark Storm appears to follow a hacktivist playbook similar to the Killnet gang, which spent most of 2023 carrying out DDoS attacks against victims who supported Ukraine until it decided to commercialize its operations in favor of a DDoS hackers-for-hire model.

SecurityScorecard researchers say Dark Storm shows “commercial motivations in addition to political ones,” and like Killnet, has begun advertising itself as a “cybercrime-as-a-service,” complete with a menu of hacking services.

“For much of its history, it [Dark Storm] has targeted NATO member states and others that have declared their support for Ukraine,” suggesting Russian geopolitical interests, the researchers said.

Still its unclear if the Dark Storm Team is made up of nuanced cybercriminals or “script kiddies” playing games to make a name for itself.

Soon after the X attacks, a sole French security researcher claimed to have uncovered the identity of the Dark Storm hacker behind the entire operation – a 20-something engineering student from Egypt.

The researcher, Baptiste Robert, CEO at Predicta Labs, laid out his strictly Open Source Intelligence (OSINT) findings on X to praise from multiple security insiders.