Threat Actor Characterization
AlphaBay Market
ID: 209787c7bfde790cd32e6c615d66533500388| AlphaBay | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
dc9d1430b872143ef05ed9a06f94610c96914 | Alexandre Cazes | Canada | related | Cybercrime |
|
af45b410b5c53c8019cfb5ba263b01b174720 | DeSnake | Canada | related | Cybercrime |
|
18f38007daf653aba9eff0fc1faa1d4e82424 | Hansa Market | Unknown | related | Darkweb Market/Service |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
AlphaBay was a large darknet marketplace that enabled cybercrime and fraud ecosystems by facilitating illicit trade in malware, stolen identities, and other contraband. It is best modeled as criminal service infrastructure rather than a single intrusion actor.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1583.001 | Domains | TA0042 |
|
| T1583.003 | Virtual Private Server | TA0042 |
|
| T1583.004 | Server | TA0042 |
|
| T1583.006 | Web Services | TA0042 |
|
| T1585.002 | Email Accounts | TA0042 |
|
AlphaBay — Darknet marketplace (criminal service infrastructure)
Classification: TLP: WHITE - Open Source Intelligence (OSINT)
Category: Cybercrime / Darknet marketplace - Origin: Mixed/Unknown (operators linked to Canada/Thailand via public cases)
Author: iQBlack CTI Team
Executive Summary
AlphaBay was a high‑volume darknet marketplace that facilitated illicit trade in narcotics, stolen and fraudulent identity documents, malware and “hacking tools,” and other contraband. Public reporting indicates it operated primarily as a Tor hidden service (and, in later iterations, with additional anonymity-layer options), using cryptocurrency payments and escrow to enable buyer/seller transactions at scale.
In July 2017, a globally coordinated law enforcement operation (“Operation Bayonet”) seized AlphaBay infrastructure and simultaneously leveraged the takedown to drive users toward another market (Hansa) that authorities had covertly controlled, enabling additional identification and arrests. Public cases identify Alexandre Cazes (Canada) as the alleged founder/administrator, arrested in Thailand on 2017‑07‑05 and later found dead in custody on 2017‑07‑12.
From a defensive-intelligence standpoint, AlphaBay should be treated less as a single “intrusion actor” and more as an enabling platform within the cybercrime supply chain: it lowered transaction costs for threat actors and supported “capability acquisition” (malware, access devices, stolen credentials, document fraud) and laundering/cash‑out ecosystems. The market’s lifecycle illustrates repeatable OPSEC failure modes (identity linkage, weak endpoint encryption discipline, operational routine) and also the persistent re-emergence of brands through re-launch claims.
