For nearly nine years, Rydox has turned identity theft into a regular online purchase, offering tens of thousands of users a huge catalog of other people's data and tools for attacks. Now the 28-year-old citizen of Kosovo, Ardit Kutleshi, admitted to the United States the creation and operation of one of the largest underground markets of this type.
Kutleshi pleaded guilty to aggravated identity theft and conspiracy to launder money. According to the case file, Rydox worked as a full-fledged cybercrime market, where buyers received ready-made data, accesses and tools, and did not search separately at different sites.
Rydox appeared around February 2016 and before the closure had managed to offer at least 321 372 criminal products of more than 18 thousand users. The catalog contained names, addresses, social security numbers, bank card details, logins and passwords, false pages for fraud, mailing logs and spam instructions.
More than 7,600 transactions involving stolen personal data, access facilities and other digital fraud products have passed through the site. The income of the organizers amounted to at least $232 thousand. Such shops have become part of the developed economy of the darknet, where the finished infrastructure reduces the entry threshold for less experienced criminals.
Rydox's final began in December 2024. Kosovo police detained Ardit Kutleshi and his brother Jetmir, and Albanian law enforcement arrested another administrator, Spenda Sokoli. At the same time, the FBI and the Malaysian police seized the servers of the site in Kuala Lumpur, the US authorities took the Rydox.cc domain and were allowed to confiscate about $225 thousand in cryptocurrency.
Ardita Kutleshi was later extradited to the United States. Jetmir Kutleshi pleaded guilty earlier, received a sentence in December 2025 and was deported to Kosovo. The international operation showed how distributed the infrastructure of the underground sites could be: the administrators were in one country, servers in another, and the victims and the investigation could be thousands of kilometers away.
After pleading guilty, Ardit Kutleshi is due to be sentenced on February 9, 2027. The theft of personal data under aggravating circumstances is subject to a minimum of two years' imprisonment, and the charge of conspiracy to launder money provides for up to 20 years' imprisonment.
A similar story has developed around BlackDB, another criminal market from Kosovo. His administrator, Lyridon Masurica, after his extradition to the United States, also pleaded guilty to the management of the site where stolen bank data, accounts and personal information were sold.
Criminal services are increasingly copying the model of the ordinary software business. The W3LL platform has been supplying attackers with tools and hacked accounts for years, and even after the store closed, sales continued through other channels.
The closure of a large site also does not always destroy the formed market. After the liquidation of the RAMP forum, its audience quickly dispersed to new platforms, so law enforcement agencies have to pursue not only individual domains, but also administrators, servers, payment infrastructure and the participants of such ecosystems themselves.
Kutleshi pleaded guilty to aggravated identity theft and conspiracy to launder money. According to the case file, Rydox worked as a full-fledged cybercrime market, where buyers received ready-made data, accesses and tools, and did not search separately at different sites.
Rydox appeared around February 2016 and before the closure had managed to offer at least 321 372 criminal products of more than 18 thousand users. The catalog contained names, addresses, social security numbers, bank card details, logins and passwords, false pages for fraud, mailing logs and spam instructions.
More than 7,600 transactions involving stolen personal data, access facilities and other digital fraud products have passed through the site. The income of the organizers amounted to at least $232 thousand. Such shops have become part of the developed economy of the darknet, where the finished infrastructure reduces the entry threshold for less experienced criminals.
Rydox's final began in December 2024. Kosovo police detained Ardit Kutleshi and his brother Jetmir, and Albanian law enforcement arrested another administrator, Spenda Sokoli. At the same time, the FBI and the Malaysian police seized the servers of the site in Kuala Lumpur, the US authorities took the Rydox.cc domain and were allowed to confiscate about $225 thousand in cryptocurrency.
Ardita Kutleshi was later extradited to the United States. Jetmir Kutleshi pleaded guilty earlier, received a sentence in December 2025 and was deported to Kosovo. The international operation showed how distributed the infrastructure of the underground sites could be: the administrators were in one country, servers in another, and the victims and the investigation could be thousands of kilometers away.
After pleading guilty, Ardit Kutleshi is due to be sentenced on February 9, 2027. The theft of personal data under aggravating circumstances is subject to a minimum of two years' imprisonment, and the charge of conspiracy to launder money provides for up to 20 years' imprisonment.
A similar story has developed around BlackDB, another criminal market from Kosovo. His administrator, Lyridon Masurica, after his extradition to the United States, also pleaded guilty to the management of the site where stolen bank data, accounts and personal information were sold.
Criminal services are increasingly copying the model of the ordinary software business. The W3LL platform has been supplying attackers with tools and hacked accounts for years, and even after the store closed, sales continued through other channels.
The closure of a large site also does not always destroy the formed market. After the liquidation of the RAMP forum, its audience quickly dispersed to new platforms, so law enforcement agencies have to pursue not only individual domains, but also administrators, servers, payment infrastructure and the participants of such ecosystems themselves.
