- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,692
It seems that even cybercriminals need a user-friendly interface.
After the closure of Huione Guarantee, a major shadow marketplace, the cybercrime market not only didn't disappear but quickly restructured itself. New players took over the vacant space and offered a more flexible and stealthy infrastructure. One such hub was Dabai Guarantee, a network of Telegram channels used to coordinate fraudulent operations across several countries.
The platform unites Chinese-speaking groups that launch financial and retail fraud schemes . These include purchasing goods using stolen card details, withdrawing cash from ATMs, and so-called "sweeping operations," where participants buy high-demand items in bulk—such as cosmetics, tobacco, or electronics—for subsequent resale. Unlike previous schemes that focused on luxury brands, these purchases appear less suspicious and are easier to handle.
Dabai Guarantee acts as an intermediary and guarantor of transactions. Participants deposit USDT cryptocurrency, after which they gain access to separate channels with tasks. The platform handles settlements and arbitration, reducing the risk of fraud between criminal groups themselves. According to analysts, it is precisely the lack of trust within the underground market that has led to the emergence of such services.
One of the groups studied, Public Group 301, coordinates operations in Japan and South Korea. A leader, nicknamed John Nouan, sets tasks, and the workers are divided into several roles: some purchase goods or withdraw funds, others receive and inspect shipments, and still others handle logistics. Once the results are confirmed, payments are distributed through the platform.
This model makes the network resistant to investigation. Teams operate independently, do not share information, and often consist of temporary members—tourists or migrants. Even if individual perpetrators are apprehended, tracking down the organizers is extremely difficult. The use of stablecoins , which allow for quick transfers of funds between countries and bypassing bank controls, provides additional anonymity.
Dabai Guarantee's Telegram infrastructure includes thousands of channels with diverse specializations—from phishing and database sales to bypassing identity checks and creating malware. Built-in bots help quickly find relevant groups by keywords, simplifying the process of adding new participants to existing campaigns.
Despite pressure from law enforcement, such platforms continue to grow. Their decentralized structure and the elimination of public websites make tracking difficult, while demand for such services remains high. Analysts estimate that similar ecosystems are becoming the main alternative to traditional darknet marketplaces and will continue to grow, attracting more and more participants worldwide.
After the closure of Huione Guarantee, a major shadow marketplace, the cybercrime market not only didn't disappear but quickly restructured itself. New players took over the vacant space and offered a more flexible and stealthy infrastructure. One such hub was Dabai Guarantee, a network of Telegram channels used to coordinate fraudulent operations across several countries.
The platform unites Chinese-speaking groups that launch financial and retail fraud schemes . These include purchasing goods using stolen card details, withdrawing cash from ATMs, and so-called "sweeping operations," where participants buy high-demand items in bulk—such as cosmetics, tobacco, or electronics—for subsequent resale. Unlike previous schemes that focused on luxury brands, these purchases appear less suspicious and are easier to handle.
Dabai Guarantee acts as an intermediary and guarantor of transactions. Participants deposit USDT cryptocurrency, after which they gain access to separate channels with tasks. The platform handles settlements and arbitration, reducing the risk of fraud between criminal groups themselves. According to analysts, it is precisely the lack of trust within the underground market that has led to the emergence of such services.
One of the groups studied, Public Group 301, coordinates operations in Japan and South Korea. A leader, nicknamed John Nouan, sets tasks, and the workers are divided into several roles: some purchase goods or withdraw funds, others receive and inspect shipments, and still others handle logistics. Once the results are confirmed, payments are distributed through the platform.
This model makes the network resistant to investigation. Teams operate independently, do not share information, and often consist of temporary members—tourists or migrants. Even if individual perpetrators are apprehended, tracking down the organizers is extremely difficult. The use of stablecoins , which allow for quick transfers of funds between countries and bypassing bank controls, provides additional anonymity.
Dabai Guarantee's Telegram infrastructure includes thousands of channels with diverse specializations—from phishing and database sales to bypassing identity checks and creating malware. Built-in bots help quickly find relevant groups by keywords, simplifying the process of adding new participants to existing campaigns.
Despite pressure from law enforcement, such platforms continue to grow. Their decentralized structure and the elimination of public websites make tracking difficult, while demand for such services remains high. Analysts estimate that similar ecosystems are becoming the main alternative to traditional darknet marketplaces and will continue to grow, attracting more and more participants worldwide.
