5 Underground Forum Profiles: Cracked, Dread, Exploit, Nulled and XSS

An exploit forum mention in a case file tells an analyst where a claim appeared, not whether a deal closed. These five names recur in cybercrime reporting, but they have very different evidence trails. Cracked and Nulled have documented 2025 seizures.

XSS has a documented arrest of a suspected administrator. Exploit and Dread appear in later court or law-enforcement accounts that describe specific historical uses. None of those records alone proves that a named service is available today.

Why Were These Five Forums Chosen, and How Is the List Ordered?

We selected Cracked, Dread, Exploit, Nulled and XSS because a dated primary record identifies each forum’s role in a specific case. We order them alphabetically. The available sources do not provide comparable, dated post counts for all five, so this is not a popularity ranking. A forum name, a marketplace, a messaging service and a seized domain are also different units of analysis.

Our comparison uses public statements from law enforcement, a Paris prosecutor release, and Brandefense’s published research method. Each profile separates a documented event from a current-status question. Entry rules are marked unknown unless a primary source explains them.

For the broader category, the hacker and leak forums guide explains how forums differ from other sources. The underground forum glossary defines the term used here.

The dates mark evidence, not a live-status check. A later filing can describe an older post. Treat each row as a lead for verification.

What Happened to Cracked?

On 30 January 2025, the United States Justice Department announced a multinational action against Cracked and Nulled. According to the department, Cracked had operated since March 2018. Its listed goods included stolen login credentials, hacking tools and servers used to host malware or stolen data. This makes a Cracked mention most relevant to stolen-account exposure, tool advertising and possible downstream fraud.

The DOJ said investigators seized servers and eight domains used by Cracked. It reported more than four million users and over 28 million posts before the action. Those are the department’s historical platform figures, not a count of unique sellers, successful sales or current users. One account could post often, and a sales listing does not show that anyone bought the item.

The release did not set out Cracked’s language, admission requirements or moderation rules. It also did not establish the status of any later service using a similar name. For an analyst, the defensible status label is “named infrastructure seized in January 2025.” If a 2026 report says “Cracked,” retain the report date and ask whether it refers to the seized platform, an archive or a different service.

What Can Be Verified About Dread?

Dread enters this comparison through a narrower record. In a May 2026 sentencing announcement, the DOJ said a defendant admitted helping create forum pages for Kingdom Market on sites including Dread. Kingdom Market operated between March 2021 and December 2023, according to that release. The Dread reference documents a communication and promotion channel used in that case.

The release lists drugs, stolen financial information, false identity documents and malware as goods offered on Kingdom Market. It does not say that Dread itself sold each category. That distinction prevents a market’s inventory from being misattributed to the forum that hosted its pages. The source also gives no Dread-specific post volume, language, admission rule or 2026 availability check.

What Does the Evidence Show About the Exploit Forum?

Exploit appears in two distinct United States Justice Department accounts. An August 2026 guilty-plea announcement says conspirators advertised stolen data on the Exploit and XSS forums, among other venues. The case concerns conduct from February through October 2024. The 2026 publication date does not turn those posts into evidence of 2026 trading.

An October 2026 DOJ release adds a specific, dated example. It says a hosting service advertised its offerings to a user on the Exploit forum in September 2024. That supports Exploit’s role as an advertising venue in the cited period. It does not establish who controlled the forum later, how admission worked, or whether the service was reachable on 12 November 2026.

The word “exploit” also appears in many unrelated product and vulnerability discussions. An analyst should distinguish the named Exploit forum from generic exploit-trade claims.

Brandefense’s 2026 exploit-trade research illustrates the problem: among 93 sampled seller posts using “0-day,” only 37 received the broad unnamed-exploit-claim code. None of those 93 named a CVE. That sample spans collected sources; it is not a count of Exploit forum posts.

For an “Exploit forum offer,” preserve the platform label, post date and claimed object. A stolen-data ad and a vulnerability claim call for different checks. A stated CVE still needs a vendor record before it changes patch priority.

What Happened to Nulled?

The same January 2025 DOJ action seized Nulled’s website domain and servers. According to a complaint described by the department, Nulled had sold stolen credentials, stolen identity documents and hacking tools since 2016. The department reported more than five million users and over 43 million posts. These figures describe the historical platform at the time of the action, not a 2026 audience.

The DOJ also alleged that an administrator performed escrow functions for transactions involving credentials and other information. That allegation explains why a forum mention can be more than casual discussion: a platform may help parties coordinate a deal. It still does not prove a particular advertisement resulted in a sale. The complaint is an allegation, and the department says defendants are presumed innocent unless proven guilty.

The release establishes seizure of identified infrastructure, but not the status of a successor. It does not state language or entry requirements. Validate any later credential claim against the organization’s own evidence.

What Does the Evidence Show About XSS?

A Paris prosecutor release dated 23 July 2025 describes the XSS forum as Russian-speaking and active since 2013. The office said it enabled sales of malware, access to compromised systems, stolen data and ransomware-related services. It also described an associated encrypted messaging server. These are the prosecutor’s historical descriptions, not a fresh audit of every category in 2026.

The same release says Ukrainian authorities arrested the person suspected of administering XSS on 22 July 2025, with French police present and Europol assisting. Its published seizure image refers to a domain seizure. The release says the investigation continued; it does not verify the status of every mirror, successor or user community in November 2026. An arrest of one suspected administrator should not be expanded into a claim that all activity ceased.

The August 2026 United States DOJ announcement separately names the XSS forum among venues where conspirators advertised stolen data from a 2024 case. That corroborates a historical role for the forum, but it does not date those advertisements to 2026. In Brandefense Blackhole, the prepared 14 August to 12 November 2026 data shows two dark-chat items tagged “xss forum.” These are mentions in a collected channel, not verified posts on XSS or evidence of its availability.

The prosecutor release does not state XSS entry rules. Test any later claim through authorized evidence, such as an account record, system log or vendor advisory.

How Should Analysts Compare Forum Mentions Without Mistaking Posts for Actors or Sales?

Start with five fields: source name, post or event date, claimed object, source type and confidence. Keep the date of a court announcement separate from the alleged conduct it recounts. A post about a credential set is not a confirmed breach, and a claim about a vulnerability is not a validated exploit. Capture the exact claim before connecting it to an asset or incident.

Next, ask what the source actually observed. A law-enforcement seizure confirms action against identified infrastructure.

A court account may describe allegations, admissions or adjudicated facts, each with a different weight. A collected post is evidence that text appeared in the collection. It does not independently establish the seller’s identity, the offered material’s authenticity or a completed exchange.

Brandefense’s full exploit-trade report method makes this distinction concrete. Its counts are collected post IDs or distinct texts in a Telegram-dominated slice, not seller totals or market size. One offer can appear in many posts, while a single account can make several claims. Do not compare those counts with DOJ’s historical platform-user figures as if both measured the same thing.

For operational use, tie a credible claim to a named internal asset, account or vendor record. Check the date, scope and independent evidence before assigning urgency. The cyber threat intelligence workflow can then connect an external mention to internal exposure and triage. Keep the original source wording and confidence label in the case note so later analysts can revisit the decision.

Recheck status from a fresh primary record before making a present-tense statement. Keep the source and its limits attached to each assessment.