Rydox cybercrime marketplace operator Ardit Kutleshi pleads guilty in US (WDPA); sentencing Feb 2027
BleepingComputer (25 September 2026) and SecurityWeek report that Kosovar national Ardit Kutleshi, 28, pleaded guilty in the US District Court for the Western District of Pennsylvania (Hon. Mark R. Hornak) to aggravated identity theft and money laundering conspiracy for creating and operating Rydox, an illicit marketplace for stolen PII, login credentials, access devices, and cybercrime tools. DOJ/USAO-WDPA materials (OPA PR URL returned HTTP 401 from this desk; facts from BC/SW quoting prosecutors): since at least 2016 Rydox facilitated over 7,600 transactions involving US victim PII and cybercrime products, with at least about US$232,000 marketplace revenue; BC additionally cites ~321,000 cybercrime products and ~18,000 users. Marketplace seized December 2024 with Kosovo Police, Albania SPAK, and Royal Malaysian Police (servers in Kuala Lumpur; Rydox[.]cc domain). Co-admins Jetmir Kutleshi and Shpend Sokoli also arrested; Jetmir previously sentenced to time served and deported. Ardit extradited 2025; sentencing set 9 February 2027 — mandatory minimum 2 years (aggravated identity theft) and up to 20 years (money laundering conspiracy). FBI Cyber Division AD Brett Leatherman quoted on takedown. DocumentCloud indictment linked from BC. Primary DOJ URL preferred when reachable; wire until then.
- Product
- Rydox illicit cybercrime marketplace (seized Dec 2024)
- Versions
- n/a (criminal plea / marketplace takedown; site offline since Dec 2024 seizure)
- Exploited in Australia?
- unknown
- Patch to
- No product patch — monitor for Rydox successor marketplaces; rotate credentials if historically purchased from credential shops; continue dark-web/marketplace threat intel coverage; sentencing 9 Feb 2027
Primary: DOJ OPA — Kosovar national pleads guilty to operating Rydox cybercrime marketplace · Vendor: BleepingComputer — Rydox marketplace admin pleads guilty (25 Sep 2026) · SecurityWeek — Kosovar owner of Rydox marketplace pleads guilty (25 Sep 2026)