BreachForums

BreachForums, a notorious cybercrime marketplace and successor to RaidForums, experienced a sudden outage on April 15, 2025, after law enforcement leveraged an undisclosed 0-day vulnerability in the MyBB forum software to infiltrate its infrastructure. Although administrators assert that no data was compromised or exfiltrated, the operation disrupted platform availability and triggered a comprehensive internal review. Users were unable to access forums or exchange illicit services throughout the shutdown period, resulting in significant community unrest and reputational damage. Despite the absence of a confirmed data breach, the incident exposed critical weaknesses in the unpatched MyBB codebase and underscored the persistent threat posed by advanced law enforcement tactics. Administrators have since completed a detailed audit, identified the PHP exploit responsible, and initiated a full back-end rewrite to mitigate any future exploits. This unplanned interruption not only affected transaction flows and forum governance but also prompted members to temporarily migrate to alternative platforms, fragmenting the user base and diluting centralized control. The downtime incurred indirect costs associated with incident response efforts and technical remediation, leaving administrators with the dual challenge of restoring service and rebuilding confidence.

Source: https://cybersecuritynews.com/breachforums-mybb-0-day/

TPRM report: https://scoringcyber.rankiteo.com/company/reliaquest

"id": "rel716042825",
"linkid": "reliaquest",
"type": "Vulnerability",
"date": "4/2025",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'industry': 'Illicit Services',
                        'name': 'BreachForums',
                        'type': 'Cybercrime Marketplace'}],
 'attack_vector': '0-day Vulnerability in MyBB Forum Software',
 'date_detected': '2025-04-15',
 'description': 'BreachForums, a notorious cybercrime marketplace and '
                'successor to RaidForums, experienced a sudden outage on April '
                '15, 2025, after law enforcement leveraged an undisclosed '
                '0-day vulnerability in the MyBB forum software to infiltrate '
                'its infrastructure. Although administrators assert that no '
                'data was compromised or exfiltrated, the operation disrupted '
                'platform availability and triggered a comprehensive internal '
                'review. Users were unable to access forums or exchange '
                'illicit services throughout the shutdown period, resulting in '
                'significant community unrest and reputational damage. Despite '
                'the absence of a confirmed data breach, the incident exposed '
                'critical weaknesses in the unpatched MyBB codebase and '
                'underscored the persistent threat posed by advanced law '
                'enforcement tactics. Administrators have since completed a '
                'detailed audit, identified the PHP exploit responsible, and '
                'initiated a full back-end rewrite to mitigate any future '
                'exploits. This unplanned interruption not only affected '
                'transaction flows and forum governance but also prompted '
                'members to temporarily migrate to alternative platforms, '
                'fragmenting the user base and diluting centralized control. '
                'The downtime incurred indirect costs associated with incident '
                'response efforts and technical remediation, leaving '
                'administrators with the dual challenge of restoring service '
                'and rebuilding confidence.',
 'impact': {'brand_reputation_impact': 'Significant Damage',
            'data_compromised': 'None',
            'downtime': 'Significant',
            'operational_impact': 'Community Unrest and Reputational Damage',
            'systems_affected': 'Entire Forum Infrastructure'},
 'initial_access_broker': {'entry_point': '0-day Vulnerability in MyBB Forum '
                                          'Software'},
 'investigation_status': 'Completed Audit',
 'lessons_learned': 'Critical Weaknesses in Unpatched MyBB Codebase, Advanced '
                    'Law Enforcement Tactics',
 'motivation': 'Disruption of Cybercrime Activities',
 'post_incident_analysis': {'corrective_actions': 'Full Back-end Rewrite',
                            'root_causes': 'PHP Exploit in MyBB Codebase'},
 'recommendations': 'Mitigate Future Exploits with Full Back-end Rewrite',
 'response': {'containment_measures': 'Comprehensive Internal Review',
              'recovery_measures': 'Technical Remediation and Service '
                                   'Restoration',
              'remediation_measures': 'Detailed Audit and Back-end Rewrite'},
 'threat_actor': 'Law Enforcement',
 'title': 'BreachForums Disruption',
 'type': 'Infrastructure Disruption',
 'vulnerability_exploited': 'PHP Exploit in MyBB Codebase'}