Russian Market

Russian Market is the dominant global marketplace for infostealer logs and corporate-credential access as of mid-2026. The platform aggregates stolen browser sessions, saved passwords, cookies, autofill records, and cloud-application tokens harvested by commodity infostealer malware, and resells them as packaged "bots" to initial-access brokers, ransomware affiliates, and fraud operators. ReliaQuest logged approximately 136,000 customer alerts tied to Russian Market in 2024, and Rapid7 and ReliaQuest jointly tracked an average of approximately 30,000 bot listings per month across the first half of 2025.

The stealer mix feeding Russian Market shifted materially during 2025. LummaC2 supplied approximately 92 percent of late-2024 listings until its May 2025 takedown, after which Acreed filled the vacuum — Acreed listings on the platform rose from dozens in early 2025 to more than 100,000 by mid-2025. From November 2025 onward Vidar has displaced both Lumma and Rhadamanthys as the most-used stealer feeding the marketplace. Flashpoint's 2026 Global Threat Intelligence Report documents approximately 11.1 million infostealer-infected machines in 2025 producing roughly 3.3 billion compromised credentials and cloud tokens circulating across stealer logs, private bundles, and initial-access-broker channels.

Why It Matters

Russian Market is the connective tissue between commodity malware operations and downstream identity-driven ransomware and business-email-compromise campaigns. The Flashpoint-documented shift from "breaking in" to "logging in" — adversaries purchasing valid corporate credentials rather than exploiting vulnerabilities — places credential-marketplace monitoring at the centre of contemporary financial-crime compliance, particularly for institutions exposed to wire fraud and treasury-account takeover.

Category: compliance, crypto history, regulatory frameworks

Explore the full Web3 Glossary — 2,085+ expert-curated definitions. Need guidance? Talk to our consultants.