ZATAZ » Darknet: dismantling of the French DFAS platform
Posted On 12 Sep 2025By : Damien Bancal
The Paris prosecutor has announced the shutdown of DFAS, one of the last major French-speaking darknet platforms, after a joint investigation by Cyberdouanes and OFAC.
On September 12, 2025, the Paris prosecutor confirmed the dismantling of the darknet platform “Dark French Anti System” (DFAS), active since 2017. Considered the last major French-speaking darknet marketplace, it facilitated drug sales, personal data trading, and criminal tools. Two men were arrested on September 8: the alleged creator, born in 1997, and an active contributor, born in 1989. More than 6 bitcoins, worth about €600,000, were seized. The investigation, launched by Cyberdouanes in 2023, uncovered over 12,000 members and 110,000 published messages. This operation closes a series of successive dismantlings carried out by French authorities since 2018.
The origins and structure of DFAS
The DFAS platform, short for “Dark French Anti System,” had been operating on the darknet since 2017. It offered various services, including drug sales, tools for fraud and cyberattacks, weapons, and guidance on user anonymization. It stood out as a rare French-speaking hub in a landscape largely dominated by English-language platforms.
One of the two men arrested, born in May 1997, is suspected of having designed and managed the platform. The second, born in April 1989, acted as a tester of its criminal services. Both suspects were brought before a judge for possible indictment.
The investigation began in 2023, led by the French customs intelligence unit DNRED. Cyberdouanes noted a steady growth in activity, despite earlier takedowns of French-speaking marketplaces. DFAS had more than 12,000 active members and over 110,000 messages. The site also served as a refuge for former users of previously dismantled platforms.
On September 8, 2025, law enforcement arrested two individuals linked to DFAS. More than 6 bitcoins, worth around €600,000, were seized. Investigators also secured technical materials documenting the platform’s operations and exchanges. The U.S. Office of Foreign Assets Control (OFAC) subsequently pursued the financial flows tied to the platform.
The end of a French-speaking darknet cycle
DFAS was the last major French-speaking darknet marketplace still active in 2025. Its shutdown follows a series of high-profile operations: La Main Noire in 2018, French Deep Web in 2021, Le Monde Parallèle that same year, and Cosa Nostra in 2024. Each closure had temporarily displaced users, but DFAS succeeded in capturing a large share of these migrations.
The Paris prosecutor’s announcement thus marks a turning point: the French-speaking darknet is now without a central hub. Criminal exchanges are dispersing across foreign platforms or smaller, harder-to-trace channels, complicating both monitoring and enforcement. [ZATAZ News English version]
Luis S. est un Genevois qui recueille des données d'intérêt public sur le darknet pour les fournir aux médias romands. Dans le cadre de cette activité, il a été perquisitionné en 2023 par la police fédérale, puis blanchi. Mais entretemps, des documents ont disparu dans les supports informatiques saisis, notamment des échanges avec des journalistes.
Extensive data leak in Switzerland: The Zurich-based asset manager Boreal Capital Management has been attacked by a hacker group, with data from around 700 current and former clients being stolen and published, according to media reports.
The German police have seized infrastructure for the darknet Nemesis Market cybercrime marketplace in Germany and Lithuania, disrupting the site's operation.
Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar Incognito Market has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from…
Suite à l’attaque contre le prestataire Xplain, des données sensibles issues des enquêtes du Parquet fédéral sont sur le dark web, selon les d'investigation du quotidien Le Temps. Une procédure de mise à jour d’un logiciel de Fedpol ne se serait pas déroulée comme le prévoit un protocole pourtant mis en place.
Après la cyberattaque contre Xplain – un des prestataires de la Confédération – les dispositifs de sécurité détaillés de Fedpol et des données de connexions de certains offices fédéraux se retrouvent sur le Darknet. Le Parlement demande des comptes.
Hackers have published data from the federal police and customs offices on the Darknet, after an attack on the servers of the host company.
We have analyzed more than 800 IT job ads and resumes on the dark web. Here is what the dark web job market looks like.
Since Hydra Market Got Shuttered by Police, Russian Rivals Battle for Market Share.
Competition between Russian-language darknet markets remains fierce following the takedown of market leader Hydra last April by a multinational law enforcement operation.
A handful of markets were responsible for trafficking most of the data.
Cyble Global Sensor Intelligence detects exploitation attempts of CVE-2022-40684, and CRIL observes Fortinet Access distribution in cybercrime forums.
En plus de Swisscom, près d'une dizaine d’entreprises helvétiques, dont Mitto, sont touchées par l’attaque contre la société iBasis, révèle «Le Temps». Des numéros suisses sont sur le darknet. Ce piratage met aussi en lumière les échanges financiers autour du roaming
