Underground forums (not to be confused with underground marketplaces) are online discussion communities that exist on both the clear web (such as HackForums, OGU, HackingForum) or in the dark web (such as dread, DarkForums, and historically RaidForums & Breached) accessible only through Tor or i2p, in which participants exchange information, tools, and services related to cybercrime and other illicit or semi-licit online activity. Topics discussed on underground forums range from malware development and the brokering of stolen data to fraud techniques, account compromise, forged identity documents, and various forms of digital abuse; some forums also overlap with dark web marketplaces trading in physical contraband such as drugs and weapons. While some underground forums require invitation, vetting, or paid membership to access certain sections, many operate as open or semi-open communities that anyone willing to register can access.
Underground forums are studied by computer security researchers, criminologists, and social scientists as a window into the organization, culture, and economics of cybercrime communities, and as a potential source of early cyber threat intelligence (CTI). Participants often discuss new techniques and vulnerabilities before they are publicly disclosed, and forum discussion has been found to precede formal security reporting for a majority of tracked threat entities.
History
Underground forums trace their origins to bulletin board systems (BBS) and early internet relay chat (IRC) communities of the 1980s and 1990s, where hobbyist hackers and "phreakers" exchanged techniques and shared access to systems. As the web matured during the 2000s, these communities moved to dedicated forum software and grew into large, persistent platforms with thousands to hundreds of thousands of registered members. Some forums, such as HackForums, have operated continuously for well over a decade and contain tens of millions of posts. A foundational empirical study of six such forums found that, unlike conventional online social networks, the pattern of communication among members did not simply encode pre-existing social relationships but instead captured dynamic trust relationships forged between mutually distrustful, pseudonymous parties. A related study modeled the social-network structure connecting individual hackers, finding that a small number of well-connected members disproportionately shape the flow of knowledge and reputation through the community.
Several members of such forums have been prosecuted for cybercrime offences, but some individuals associated with these communities have also gone on to legitimate security careers. For example, the security researcher Marcus Hutchins, later known for helping to halt the spread of the WannaCry ransomware attack in 2017, took part in underground forums as a teenager before starting his professional career in cybersecurity.
Structure and organization
Underground forums are typically organized hierarchically. A site contains multiple boards (topic categories); each board contains multiple threads (discussion topics); and each thread contains a sequence of posts (individual messages) ordered by time, with the topic of a thread generally set by its first post. Criminologists have characterized such forums as offender convergence settings, where market, social, and learning functions overlap within a single community.
Many forums run reputation systems, escrow services, or vetting processes meant to reduce fraud between members engaged in illicit trade, since participants cannot fall back on legal recourse to resolve disputes. One influential analysis frames these mechanisms through the lens of common-pool resource governance, arguing that a forum's long-term sustainability depends on collective norms of exclusion and enforcement among its members. Some forums maintain dedicated sections for processing transaction "contracts" between buyers and sellers, recording details such as the goods or services exchanged, the payment terms, and the reputation ratings of the parties involved. Despite these mechanisms, qualitative case studies of individual forums have found that trust often remains hard to establish even among vetted members, with interactions frequently marked by suspicion and accusations of fraud.
Underground forums vary considerably in scope and specialization. Some are broad, general-purpose cybercrime communities covering many topics; others focus narrowly on niches such as account compromise, search engine optimization (SEO) fraud, video game cheating, passive-income schemes, or romance scams (sometimes called "e-whoring"), a niche examined in a dedicated study of the practice on English-language forums. Others are invitation-only and closely vetted. Darkode, described by a U.S. federal prosecutor as one of the most sophisticated English-speaking forums for criminal computer hackers, required prospective members to be nominated and vetted by existing members before admission, and was dismantled by the FBI in a coordinated international operation in July 2015. Major forums operate in numerous languages, including English, Russian, German, Arabic, and Spanish, with linguistic and cultural conventions differing across communities. Researchers have used topic-modelling methods to study these multilingual settings, including an analysis of a single Russian-English invite-only forum that examined whether its language divide splits members into distinct sub-communities.
A particularly prominent category is data leak brokerage: forums dedicated to trading stolen databases obtained through breaches, exposing material such as account credentials, payment card numbers, and other personally identifiable information. This activity was documented in some of the earliest empirical studies of underground trade. A crime-script analysis of thirteen English- and Russian-language stolen-data forums broke the underlying market into discrete stages, from the acquisition or manufacture of stolen data through advertisement, sale, and the subsequent laundering of proceeds. Several of the largest and most heavily disrupted forums in the underground ecosystem, including RaidForums, BreachForums, and LeakBase, have specialized primarily in this activity, and have often become the first point of public exposure for a major corporate data breach before the affected organization itself discloses the incident.
Other recurring categories of forum content include the sale or creation of forged identity documents, such as fake driver's licenses and passports, which are often advertised alongside related fraud services such as synthetic-identity kits. Weapons and illegal drugs are also discussed and advertised. The actual transactional trade in physical contraband such as drugs and firearms, however, is more commonly associated with dedicated dark web marketplaces, such as AlphaBay, than with discussion-oriented forums. The two types of site remain closely related: they frequently share infrastructure or escrow systems, and are sometimes hosted on the same domain or used interchangeably by participants. Dread, a Reddit-style Tor-based forum, is a notable example of a discussion forum that sits at this overlap, hosting drug-related discussion, vendor reviews, and marketplace announcements alongside more conventional hacking and cybercrime content.
Carding forums, a subtype dedicated to payment-card fraud, have also been studied comparatively; an analysis of five such forums found substantial variation between them in accessibility, membership growth, and the concentration of trading activity among a small number of highly active sellers.
Anonymity and pseudonymity
Anonymity is central to the operation of most underground forums, since the activity they host is frequently illegal. Forums hosted as Tor onion services rely on Tor's onion routing to hide both the physical location of the server and the identity of visitors connecting to it. Forums on the clear web instead depend mainly on member pseudonymity, because the server's own location and operator are usually traceable through standard infrastructure-identification techniques unless additional measures, such as bulletproof hosting, are used. Participants typically interact under persistent pseudonymous handles rather than real identities. Many forums encourage or require the use of PGP-signed messages, both to verify a user's identity across mirrors or address changes (see migration) and to encrypt sensitive communications, such as the details of a transaction, from other forum members or potential eavesdroppers. Because pseudonyms can be reused across platforms, researchers have also developed stylometric techniques to link accounts belonging to the same individual across different forums, which raises further de-anonymization risks for participants who reuse writing habits or handles.
Financial transactions on underground forums are conducted through cryptocurrency, historically Bitcoin, because of its pseudonymous nature and ease of use. However, the increasing sophistication of blockchain analysis used by law enforcement and commercial firms to de-anonymize Bitcoin transactions has driven a partial shift toward privacy-focused cryptocurrencies such as Monero on forums and marketplaces handling higher-value or higher-risk transactions.
Notable examples
A number of underground forums have achieved particular prominence, whether through their size, their longevity, or their role in major data breaches and law-enforcement investigations.
Hack Forums is one of the longest-running English-language hacking communities, having operated since 2007 and accumulated tens of millions of posts.
RaidForums operated from 2015 to 2022 as one of the largest forums for trading stolen databases, with more than 500,000 registered users at the time of its disruption. The forum was seized by the FBI and Europol in April 2022 in a coordinated operation codenamed "Tourniquet", and its administrator, Diogo Santos Coelho, was arrested and charged with conspiracy, access device fraud, and aggravated identity theft.
BreachForums emerged in March 2022 as a successor to RaidForums and became one of the leading English-language platforms for data-breach discussion and stolen-data trading. The forum has been disrupted by law enforcement several times, including the arrest of an administrator in March 2023, and was cited by the U.S. Department of Justice as a predecessor cybercrime marketplace in connection with the later seizure of the forum LeakBase.
Darkode operated as an invitation-only, closely vetted forum until it was dismantled in a coordinated international law-enforcement operation in July 2015; researchers who studied its leaked database found that its rigorous, introduction-based admission process did not eliminate persistent distrust and fraud accusations among members.
XSS (formerly DaMaGeLaB), active since 2013 and one of the two central Russian-language forums alongside Exploit, dealt in exploit sales, malware, access-broker listings, and ransomware-related services, and ran an associated encrypted Jabber server used by cybercriminals to communicate. On 22 July 2025, the forum's suspected administrator was arrested in Kyiv, Ukraine, in a joint operation led by the French police and the Paris prosecutor's office together with Ukrainian authorities and Europol, following a four-year investigation. Europol said the suspect had been active in cybercrime for nearly two decades and had made more than €7 million, mainly from advertising and facilitation fees, while also acting as a trusted third party who arbitrated disputes and guaranteed transactions between members.