Full Report
There’s an update on a previously reported case: Tampa, Florida – United States Attorney Gregory W. Kehoe announces that Liridon Masurica (33, Gjilan, Kosovo), also known as “@blackdb,” has pleaded guilty to conspiracy to commit access device fraud. Masurica faces a maximum penalty of 10 years in federal prison. A sentencing date has not yet been... Source
Analysis Summary
# Incident Report: Operation of BlackDB.cc Criminal Marketplace
## Executive Summary
This report summarizes the legal conclusion of an investigation into Liridon Masurica, also known as "@blackdb," who pleaded guilty to conspiracy to commit access device fraud for operating the BlackDB.cc online criminal marketplace. The marketplace operated from 2018 to 2025, facilitating the sale of compromised financial and personal data primarily stolen from U.S. individuals, which was subsequently used for various cybercrimes. The investigation culminated in Masurica's arrest in Kosovo in December 2024 and subsequent extradition to the United States.
## Incident Details
- **Discovery Date:** Not explicitly stated (investigation ongoing until arrest). The marketplace operated from 2018 until 2025, with the arrest occurring on December 12, 2024.
- **Incident Date:** Ongoing operation from 2018 to 2025.
- **Affected Organization:** No specific victim organization, but the impact targeted numerous individuals and entities whose data was sold.
- **Sector:** Cybercrime/Underground Economy.
- **Geography:** Seller located in Gjilan, Kosovo; victims primarily located in the United States, including the Middle District of Florida.
## Timeline of Events
### Initial Access
- **Date/Time:** Operation began in 2018.
- **Vector:** Acquisition and sale of compromised data (account credentials, server credentials, credit card information).
- **Details:** The core activity was hosting and administering the BlackDB.cc marketplace.
### Lateral Movement
- *Not Applicable to the operator's activity; this describes the criminal ecosystem where buyers used the purchased data for further attacks.* Buyers reportedly used the data for tax fraud, credit card fraud, and identity theft.
### Data Exfiltration/Impact
- Illegal sale of compromised:
- Account and server credentials.
- Credit card information.
- Personally Identifiable Information (PII) of individuals.
### Detection & Response
- **How it was discovered:** Investigation led by the FBI in cooperation with local authorities.
- **Response actions taken:** Authorities in Kosovo arrested Liridon Masurica on December 12, 2024. He was subsequently extradited to the United States, where he pleaded guilty on September 9, 2025.
## Attack Methodology
*Note: This section describes the methodology of the *marketplace operator* (Masurica) rather than a typical network intrusion.*
- **Initial Access:** Operating the online platform BlackDB.cc (2018-2025).
- **Persistence:** Maintaining the administrative role of the marketplace.
- **Privilege Escalation:** Not applicable to the operator role described.
- **Defense Evasion:** Operating an international, likely darkweb-based, marketplace to evade U.S. jurisdiction.
- **Credential Access:** Facilitating the sale of *vulnerabilities/credentials* acquired by others.
- **Discovery:** Not applicable to the operator role described.
- **Lateral Movement:** Not applicable to the operator role described.
- **Collection:** Selling data that enabled further collection (fraud, identity theft) by buyers.
- **Exfiltration:** Distributing compromised data for financial gain via the marketplace.
- **Impact:** Enabling downstream cyber fraud (tax, credit card, identity theft) against U.S. victims.
## Impact Assessment
- **Financial:** Masurica faces 10 years in federal prison; significant financial losses are implied due to the resulting fraud facilitated by the sold data.
- **Data Breach:** Compromise of account credentials, server credentials, credit card data, and PII primarily affecting U.S. persons.
- **Operational:** No specific business disruption mentioned, as the incident centers on criminal infrastructure maintenance, not a corporate network intrusion.
- **Reputational:** Primarily impacts the reputation of those whose data was compromised and sold.
## Indicators of Compromise
*Since this involves a criminal marketplace, IoCs relate to the actor/platform.*
- **Network indicators (Defanged):** BlackDB.cc (marketplace URL)
- **File indicators:** Not applicable.
- **Behavioral indicators:** Operating an international marketplace for illicit data sales between 2018 and 2025.
## Response Actions
- **Containment measures:** Arrest of the administrator (Liridon Masurica) by Kosovo Police on December 12, 2024, removing the marketplace source.
- **Eradication steps:** Cooperation between the FBI, U.S. Attorney's Office, and Kosovan authorities ensured the arrest and extradition.
- **Recovery actions:** Prosecution and securing the guilty plea from the lead administrator.
## Lessons Learned
- **Key takeaways:** International cooperation (FBI, DOJ OIA, Kosovo Police) is crucial for dismantling transnational cybercriminal infrastructure. Long-running cybercriminal operations (7 years in this case) can persist until targeted international law enforcement action is taken.
- **What could have been done better:** The seven-year lifespan of the marketplace suggests initial detection or disruption capabilities could have been enhanced.
## Recommendations
- **Prevention measures for similar incidents:** Enhance international intelligence sharing focused on identifying and mapping dark web/criminal marketplace administrators. Prioritize extradition treaties and mutual legal assistance for prosecuting operators of platforms facilitating widespread PII and financial fraud.