3 Most Active Cybercrime Groups Selling Credentials in 2024

According to Fortinet, a US-based cybersecurity firm, three cybercrime groups were most active in selling credentials on the darknet in 2024. Credentials are data containing information such as usernames and passwords.

The three most active cybercrime groups in this segment in 2024 are:

• BestCombo

Fortinet observed this group's activity reaching 20%. According to Fortinet, BestCombo is a high-volume supplier of stolen credentials, often selling newly acquired hacking results bundled in large, ready-to-use lists.

• BloddyMery

This group's activity reached 12%. Fortinet reports that BloddyMery is known for collecting and enhancing leaked data. The group makes stolen credentials more valuable for resale and enhances attacks against targeted parties.

• ValidMail

Similar to BloddyMery, Fortinet noted this group's activity also reached 12%. ValidMail is described as specializing in credential validation services. This ensures buyers only receive functional login details, increasing the success rate of attacks.

Fortinet states that credential trading is among the most active activities on the darknet. In 2024, over 100 billion records were shared on underground forums. This represents a 42% increase from 2023.

This surge was largely driven by combo lists – large datasets containing email addresses, usernames, and passwords obtained from past data breaches.

The groups selling this information on the darknet are said to be providing data in a simpler format. The sellers aim to make it easier for buyers to use.

"This lowers the barrier to entry for cybercriminals and significantly amplifies the risk of account takeovers, financial fraud, and corporate espionage," stated Fortinet in its report, 2025 Global Threat Landscape Report.