German police have raided and shut down Cyberbunker 2.0, a decommissioned NATO bunker that housed dark web market servers and child porn. The bunker, hidden in the Mosel River town of Traben-Trarbach, held multiple stories of servers as well as “$41 million worth of funds allegedly tied to these markets,” according to security researcher Brian Krebs.
“Incredibly, for at least two of the men accused in the scheme, this was their second bunker-based hosting business that was raided by cops and shut down for courting and supporting illegal activity online,” said Krebs.
Police also raided locations in Netherlands, Poland and Luxembourg in connection with the bunker’s activities. The bunker held multiple dark web markets including the financial scam site “Wall Street Market,” drug portal “Cannabis Road” and “Orange Chemicals,” a market for synthesized drugs.
Bunker schematic. (Image via German Police)Police believe the bunker belonged to Herman Johan Xennt and Sven Kamphuis, two hackers who originally ran a similar bunker in the Netherlands. After a fire caused by an explosion in an ecstasy lab, they had to shut down their original bunker and lost their ability to run their servers in the Netherlands. They moved into the new Cyberbunker in 2013.
“They’re known for hosting scammers, fraudsters, pedophiles, phishers, everyone,” said Guido Blaauw, director of Disaster-Proof Solutions, the company that sold the original bunker to the pair. “That’s something they’ve done for ages and they’re known for it.”
The whole operation was deeply secretive and connected to organized crime. Xennt himself was quite a character. The Irish Sunday World tracked him down in 2015 saying:
Xennt, who looks like a Bond villain, lives in the bunker. He is pasty, white-skinned and sports long blonde hair. He rarely shows his face in public, but when he does, it is to meet with his close friend [an organized crime figure] who has moved to an apartment in the town below.
Cyberbunker servers image via swr.de