On December 1, 2023, Sandu Boris Diaconu, a 31-year-old Moldovan national, pleaded guilty in a United States federal court to charges stemming from his operation of the E-Root Marketplace — a sprawling cybercrime platform that sold access to over 350,000 compromised computer credentials. The guilty plea, which took place in the U.S. District Court for the Middle District of Florida, marks a significant milestone in the ongoing battle against digital credential trafficking and the broader cybercrime economy.
The Threat Landscape
The E-Root Marketplace operated as a sophisticated criminal marketplace from January 2015 until its takedown in late 2020. During its five-year run, the platform facilitated the sale of Remote Desktop Protocol (RDP) and SSH credentials, allowing buyers to search for compromised computers based on specific criteria including geographic location, operating system, internet service provider, and price. The marketplace took deliberate steps to hide the identities of its administrators, buyers, and sellers, operating across a widely distributed network infrastructure.
The credentials sold through E-Root enabled a range of criminal activities, from data theft and ransomware deployment to stolen identity tax fraud schemes. Court documents revealed that the platform even offered for sale access to computers belonging to at least one local government agency in Tampa, Florida. The victims spanned multiple industries and countries, reflecting the truly global nature of the threat.
Core Principles
The E-Root case illustrates several foundational principles of cybersecurity that remain critically relevant as we enter December 2023 with Bitcoin trading near $38,700. First, credential hygiene is paramount. The vast majority of the credentials sold on E-Root were obtained through phishing campaigns, brute-force attacks, and credential stuffing — all of which exploit weak or reused passwords. Organizations and individuals must adopt multi-factor authentication (MFA) as a non-negotiable security measure.
Second, the case demonstrates the importance of threat intelligence sharing. The investigation that led to Diaconu’s arrest involved cooperation between multiple law enforcement agencies across jurisdictions, highlighting that cybercrime cannot be combated in isolation. Third, the marketplace’s use of cryptocurrency — specifically Bitcoin — and the payment system Perfect Money for transactions underscores the dual-use nature of digital currencies, where the same technology enabling legitimate commerce can also facilitate illicit activities.
Tooling and Setup
Protecting against credential-based attacks requires a layered defense strategy. At the organizational level, this includes deploying endpoint detection and response (EDR) solutions, implementing network segmentation to limit lateral movement, and conducting regular vulnerability assessments. Identity and access management (IAM) platforms should enforce the principle of least privilege, ensuring that users only have access to the resources they absolutely need.
For individual users, the tooling is more accessible than ever. Password managers like Bitwarden or 1Password generate and store unique, complex passwords for each service. Hardware security keys (such as YubiKey) provide phishing-resistant two-factor authentication. Regular dark web monitoring services can alert users when their credentials appear in data breaches, enabling rapid remediation through password changes.
Ongoing Vigilance
Diaconu was arrested in May 2021 while attempting to flee the United Kingdom and was extradited to the United States in October 2023. The two-year gap between arrest and extradition, followed by the guilty plea, demonstrates the slow but persistent nature of international cybercrime prosecution. He faces up to 42 months in federal prison, and the law enforcement seizure of E-Root’s infrastructure represents a tangible victory.
However, the threat persists. New marketplaces continually emerge to fill the void left by those that are dismantled. The cryptocurrency ecosystem, with its growing market capitalization and approximately 575 million holders worldwide as of December 2023, presents an expanding attack surface. As Bitcoin hovers near $38,688 and Ethereum trades around $2,087, the financial incentives for cybercriminals have never been greater.
Final Takeaway
The E-Root Marketplace guilty plea is a reminder that accountability in cyberspace is possible, even if it takes years to achieve. For the crypto community specifically, it reinforces the need to treat security as a foundational practice rather than an afterthought. Use unique passwords, enable multi-factor authentication on all accounts — especially exchange and wallet accounts — and monitor your digital footprint for signs of compromise. The tools and knowledge to protect yourself exist. The question is whether you use them before an attacker finds you.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Always conduct your own research and consult with qualified professionals.
350k compromised credentials over 5 years and he only got caught because of an FBI takedown. the darknet economy is terrifyingly efficient
5 years operating freely too. makes you wonder how many similar markets are still running rn
350k creds over 5 years is actually a low estimate. most RDP markets sell the same credentials multiple times before they get rotated
been saying for years, RDP access sales are a bigger threat than most people realize. glad they finally got this guy
RDP access plus geographic filtering means attackers were specifically targeting systems. this wasnt random, it was a search engine for hacked machines
350k credentials searchable by ISP and operating system. basically a shopping catalog for botnet operators
Adaeze O. exactly, the geo filter turned it into a targeting platform. you could search for hospital systems in specific countries and get RDP access in minutes
same RDP access sold multiple times to different buyers. ransomware operators AND data thieves hitting the same machine simultaneously
350k credentials over 5 years and one guilty plea in florida. the replacement markets were live on telegram before the FBI press conference ended
5 years running before the FBI caught him. meanwhile the replacement markets were probably already live before e-root got seized
iri_force_ replacement markets were probably live before the seizure was even announced. hydra got taken down and three new ones appeared overnight
350k credentials with geographic and ISP filtering. basically a search engine for compromised machines in specific countries. the hospital targeting alone shouldve added years to his sentence
the geo filter letting you target hospital systems by country is the detail that should have added decades to his sentence. RDP access to healthcare infrastructure should be treated like a weapons charge
5 years operating from 2015 to 2020 selling RDP and SSH access. Moldovan national prosecuted in Florida. cybercrime extradition is getting better but hes probably a small fish compared to the operators still running
Amara N. russian RDP markets moved to telegram within weeks. take down one marketplace and three more pop up with better opsec
350k credentials searchable by OS and ISP for 5 years. the search functionality is what made it a B2B tool for ransomware crews, not just individual fraud
the geographic search filter is what made e-root dangerous. you could target specific countries hospitals, gov systems, anything
a 31 year old from Moldova running a global credential marketplace for 5 years. cybercrime prosecution is always playing catch up
bazaar_punk_ one guilty plea in middle district of florida is a drop in the ocean. the russian RDP markets moved to telegram within weeks of e-root going down
bazaar_punk_ 5 years is nothing. romanian cybercrime rings from the same era are still operating under different names today
Mirela V. romanian rings from the same era are still active. one guilty plea in Florida doesnt change the supply side of this market at all
350000 compromised credentials sold over 5 years and nobody noticed until the FBI got involved. RDP access is scary powerful in the wrong hands
Mira J. the geographic search filter is the scariest part. you could literally target specific countries infrastructure
searchable marketplace for compromised machines filtered by ISP and OS. basically Amazon for hackers. 5 year run is wild
hospital systems searchable by country is the part that should have been the lead paragraph. RDP access to healthcare infra is a body count waiting to happen
cred_scavenger_ hospital systems searchable by country is the detail that should have added decades to his sentence. RDP access to healthcare infrastructure is a body count waiting to happen