An introduction to the Spanish-language underground

The Spanish-language cybercriminal underground is “a largely unstable and unpredictable community”, according to Flashpoint’s Cybercrime subject matter expert, Liv Rowley. In March of this year, the top dark web forum, Cebolla Chan 3.0, came back online, after an absence of more than a year. The behaviour of the forum’s users while it was down, and now that it’s active once again, highlights the ways in which the Spanish-language underground is evolving. We spoke to Rowley to find out more about Cebolla Chan 3.0, the threat that the Spanish-language cybercriminal underground poses, and how we can disrupt threats from this ecosystem.


What can you tell us about Cebolla Chan 3.0 and its users?

Cebolla Chan 3.0 is the top Spanish-language underground forum, at least in terms of perceived reputation. If you throw “Cebolla Chan 3.0” into a search engine, you will find YouTube videos and blog posts celebrating and immortalizing the forum. Part of the reason Cebolla Chan 3.0 rose to such prominence likely has to do with its inclusion in the “Hidden Wiki,” a sort of Yellow Pages to the deep and dark web. The Hidden Wiki is many people’s first stop on the dark web, and Cebolla Chan 3.0 became the second stop for many Spanish-speakers.

Cebolla Chan 3.0 has had a peculiar history. The site first appeared in October 2014, then went offline in September 2016. The explanation that was given was that there would be going offline in order to improve operational security. Nobody, however, heard publicly from Cebolla Chan 3.0 (or any associated admins, etc.) until March 2018, when the site unexpectedly came back online (while I was working on my presentation for RSA – it led to several changes in what I had originally planned!). By back online, I mean back online – the URL is the same, the posts on the site from before the site went offline are still there, and accounts that were created in 2014, 2015, 2016, are seen being active on the forum again. Members of Cebolla Chan 3.0 are still waiting on an explanation for what happened here. Despite this strange activity, people are flocking back to Cebolla Chan 3.0.

To continue reading...


« CIO Spotlight: Mark Hopkins, Skullcandy, Inc.


C-suite talk fav tech: Bastian Nominacher, Celonis »
Kate Hoy

Kate Hoy is Editor of IDG Connect

  • twt
  • twt
  • Mail