Loading story…
The FBI seized and shut down domains associated with NudeLeaksTeens and NLTVIDS, sites used to advertise, distribute and sell child sexual abuse material (CSAM) and nonconsensual intimate content, including AI-generated deepfakes. French authorities arrested an unnamed 25-year-old French resident suspected of being the sites’ primary administrator. The coordinated action formed part of Operation Inevitable, which targets CSAM and the nonconsensual publication of intimate images.
Investigators linked some of the material to hacked social media accounts, extortion and collections associated with previously convicted offenders. The sites monetized content through individual purchases and bundles organized by victim, encouraged cryptocurrency payments and claimed to link to externally hosted files rather than store them directly. The FBI is directing potential victims to its dedicated reporting portal at ncii.ic3.gov.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Arlington County police detective and FBI cybercrime task force member John Bamford filed a seizure warrant in the Eastern District of Virginia targeting the websites.
Andrew Venegas was sentenced to 30 years after pleading guilty in a Texas federal court to sexual exploitation of children and receipt of child sexual abuse material. Investigators found that he obtained explicit material through extortion and unauthorized access to victims’ social media accounts.
Law enforcement first became aware of the websites in 2024. The sites advertised hacked, leaked, and stolen child sexual abuse material.
One of the websites offered a collection named after Reuben Oswaldo Yeverino Rosales in 2022 and 2023.
Reuben Oswaldo Yeverino Rosales was convicted and sentenced to more than 34 years in prison for sexual exploitation of children and cyberstalking.
The US Attorney’s Office for the Eastern District of Virginia identified the enforcement action as part of Operation Inevitable, targeting child sexual abuse material and nonconsensual intimate images. Authorities asked potential victims to report through the FBI’s dedicated portal at ncii.ic3.gov.
French police also arrested the suspected NudeLeaksTeens administrator’s 21-year-old brother, and investigators seized approximately €700,000 in cryptocurrency at the brothers’ homes. French authorities reported that the platform had more than 17,000 female victims worldwide.
French authorities arrested an unnamed 25-year-old French resident suspected of being the websites’ primary administrator.
US and French authorities seized the domains associated with NudeLeaksTeens and NLTVIDS, shutting down websites used to advertise and sell child sexual abuse material and nonconsensual intimate content, including AI-generated deepfakes. FBI officials executed a search warrant on domain registry VeriSign and reportedly took servers, computers, and other material.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcehackread.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities seized the domains **CFAKE.com** and **SOCFAKE.com**, alleging the sites published thousands of non-consensual sexually explicit deepfake images and videos of women, including celebrities, politicians, journalists, athletes, and royalty. The action was carried out by the Departments of Justice and Homeland Security under the **TAKE IT DOWN Act**, a 2025 law that criminalizes unauthorized publication of sexually explicit digital forgeries. Officials said the platforms hosted abusive content categories such as “rape,” “forced,” and “degradation,” and described the operation as a major effort to stop psychologically harmful exploitation of victims. The takedown followed a multinational investigation that began after Italy’s **Polizia di Stato** alerted U.S. authorities and expanded through evidence sharing with France under the **Budapest Convention on Cybercrime**. In a parallel French case, police in Nice arrested a 47-year-old French national accused of serving as a CFAKE administrator and seized site-related computer equipment along with more than **$48,000 in Ethereum**. French investigators linked the platform to roughly **300,000 images**, **7,000 videos**, **14,000 depicted individuals**, about **200,000 user accounts**, and nearly **4 million monthly views**, underscoring the scale of the alleged abuse network.
Jun 29, 2026
The Manhattan District Attorney’s Office seized the domains of 12 websites accused of creating and hosting sexually explicit, nonconsensual AI deepfakes of real people. The platforms allegedly enabled users to fabricate pornography using victims’ faces and bodies and collectively hosted material involving more than 1,200 people, including celebrities, politicians, other public figures, and survivors of domestic abuse. District Attorney Alvin Bragg said the investigation remains ongoing and that prosecutors will watch for efforts to reconstitute the services on replacement domains. The seizure, described as among the largest legal actions against explicit-deepfake sites, targets a form of sexual exploitation that can damage victims’ personal and professional lives and be used to threaten victims with distribution of fabricated imagery.
Sep 17, 2026
The **FBI**, working with European and other international law enforcement partners, seized and dismantled the **LeakBase** cybercriminal forum and marketplace in a coordinated action dubbed **“Operation Leak.”** LeakBase, active since 2021 and run as a subscription-based service, was used to buy, sell, and share stolen databases and sensitive data including **compromised credentials**, **PII**, payment data, and other access-enabling information; authorities warned that the forum facilitated activity that could enable access to U.S.-based networks, including potentially **critical infrastructure**. Authorities redirected LeakBase domains (including `leakbase[.]ws` and `leakbase[.]la`) to an FBI seizure banner and moved DNS to bureau-controlled infrastructure (e.g., `ns1.fbi.seized.gov`, `ns2.fbi.seized.gov`). The takedown was executed under U.S. and German court orders, and officials stated they secured and preserved the forum’s content for evidentiary purposes, including user accounts, posts, private messages, and **IP logs**. The operation reportedly included **100 law enforcement actions** against **45 targets** across more than a dozen countries, disruption of hosting infrastructure spanning locations such as the Netherlands and Malaysia, and outcomes including **13 arrests**, **32 searches**, and interviews with **33 suspects**; the investigation was led by the FBI’s Salt Lake City field office, and the FBI solicited tips via `FBI-SU-Leakbase@fbi.gov`.
Jun 29, 2026