INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Kosovar National Pleads Guilty to Operating Cybercrime Marketplace

| 2026-09-25 12:16 LOW LOW LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
A Kosovar national, Ardit Kutleshi, pleaded guilty in a US court to charges related to the creation and administration of Rydox cybercrime marketplace. The individual was extradited to the US last year after being arrested along with his brother Jetmir and Shpend Sokoli in December 2024. At least 321,372 cybercrime products were allegedly offered on Rydox, including stolen information such as names, addresses, credentials, credit cards, and Social Security numbers. The marketplace allowed users to trade this information for phishing kits, stealer logs, and spamming tools, with over 7,600 transactions made between 2016 and 2024 generating at least $232,000 in revenue. Kutleshi pleaded guilty to identity theft and money laundering conspiracy charges, facing two years of mandatory prison for aggravated identity theft and up to 20 years in prison for money laundering.
Technical Mitigations AI-generated
• Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Restrict Web-Based Content (ATT&CK mitigation for Phishing): Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, etc.) that can be used for phishing are necessary for business operations and consider bloc
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ww•••••.cc
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
RyukRyuk
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance
Incident Timeline
‎December 2024
The United States judicially seized the Rydox marketplace domain in December 2024, following an arrest of its owner, Ardit Kutleshi.
source_region United States
Rydox was disrupted in December 2024, when the US obtained judicial authorization to seize www.Rydox.cc, the domain that hosted the marketplace.
Kutleshi was arrested by Kosovo law enforcement in December 2024 and extradited from Kosovo to the United States in 2025.
In December 2024, the United States also judicially seized the domain www.Rydox.cc, which hosted and facilitated access to the Rydox website.
organisation Rydox
At least 321,372 cybercrime products were allegedly offered on Rydox, including stolen information such as names, addresses, credentials, credit cards, and Social Security numbers, along with phishing kits, stealer logs, and spamming tools.
organisation Social Security
At least 321,372 cybercrime products were allegedly offered on Rydox, including stolen information such as names, addresses, credentials, credit cards, and Social Security numbers, along with phishing kits, stealer logs, and spamming tools.
organisation PII
According to court documents, Rydox allowed cybercriminals to trade stolen personally identifiable information (PII), stolen payment card data, account credentials, and cybercrime tools.
victims 18,000 users
Rydox was estimated to have had approximately 18,000 users when taken down.
‎2025/09/25
The Kosovar owner of Rydox Marketplace was extradited to the US last year and subsequently pleaded guilty in a US court.
target_region United States
He was extradited to the US last year.
‎December 2025
Ardit Kutleshi, a Kosovar owner of the Rydox marketplace, pleaded guilty in a US court.
‎between 2016 and 2024
Threat actors exploited the Rydox Marketplace between 2016 and 2024, generating at least $232,000 in revenue through more than 7,600 transactions.
general_metric 7,600 transactions
More than 7,600 transactions were made through the marketplace between 2016 and 2024, and its operators received at least $232,000 in revenue.
financial $232,000 operators
More than 7,600 transactions were made through the marketplace between 2016 and 2024, and its operators received at least $232,000 in revenue.
‎2026/09/25
Ardit Kutleshi, a Kosovar national and operator of the illicit Rydox marketplace, pleaded guilty to charges related to his creation and operation of the website.
organisation Kosovar Owner
Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court.
organisation US Court
Kosovar Owner of Rydox Marketplace Pleads Guilty in US Court.
organisation Kosovar
A Kosovar national pleaded guilty in a US court to charges related to the creation and administration of the Rydox cybercrime marketplace.
Ardit Kutleshi, 28, a Kosovar national, pleaded guilty to charges related to his creation and operation of Rydox, an illicit website and marketplace for cybercriminals to buy, sell and trade stolen personal information, and to access devices and other tools for carrying out cybercrime and fraud.
organisation Rydox
Ardit Kutleshi, 28, a Kosovar national, pleaded guilty to charges related to his creation and operation of Rydox, an illicit website and marketplace for cybercriminals to buy, sell and trade stolen personal information, and to access devices and other tools for carrying out cybercrime and fraud.
organisation PII
According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.
financial $232,000 operators
According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.
organisation Kosovar National Pleads Guilty
Kosovar National Pleads Guilty to Operating Cybercrime Marketplace Offering Tools and Products to Cybercriminals.
organisation Ardit Kutleshi
“The guilty plea of Ardit Kutleshi for operating the Rydox marketplace exposes a sophisticated scheme to profit from stolen identities and cybercrime tools,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
organisation the Justice Department’s Criminal Division
“The guilty plea of Ardit Kutleshi for operating the Rydox marketplace exposes a sophisticated scheme to profit from stolen identities and cybercrime tools,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
organisation the Justice Department
“This guilty plea sends a strong message to all cybercriminals that the Justice Department will identify, arrest, and prosecute cybercriminals regardless of where they are in the world through international cooperation, technical expertise, and cutting-edge law enforcement.”
organisation the District Court
Kutleshi pleaded guiltyin the District Court for the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy.
organisation the U.S. Sentencing Guidelines
A federal district court judge will determine the sentence after considering the U.S. Sentencing Guidelines and other statutory factors.
organisation the Criminal Division’s Computer Crime
Senior Counsel Thomas Dougherty of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Nicole Stockey for the Western District of Pennsylvania are prosecuting the case.
organisation IP
Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds.
‎February 9, 2027
Kutleshi pleaded guilty to identity theft and money laundering conspiracy charges.
organisation Microsoft
Related: US Court Sentences Armenian Man to Prison for Ryuk Ransomware Attacks Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft Related:
‎Feb. 9, 2027
The Kosovar owner of Rydox Marketplace has pleaded guilty to aggravated identity theft and money laundering conspiracy charges.
Tactical Metrics
Metrics
financial
232,000
Financial Impact / Stolen Funds
More than 7,600 transactions were made through the marketplace between 2016 and 2024, and its operators received at least $232,000 in revenue.
According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.
Metrics
victims
18,000
Users
Rydox was estimated to have had approximately 18,000 users when taken down.
Intelligence Sources
SecurityWeek 2026-09-25
Data Breaches 2026-09-24