{
  "id": "case-incognito-siew",
  "slug": "us-v-siew-incognito-market",
  "title": "U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion)",
  "summary": "Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.",
  "case_number": "1:24-cr-00305",
  "court": "U.S. District Court for the Southern District of New York",
  "district": "S.D.N.Y.",
  "country": "United States",
  "opened_at": "2024-05-20",
  "status": "charged",
  "victim_sector": "Consumer Privacy, Cryptocurrency",
  "victim_country": "United States, Taiwan",
  "loss_amount_usd": 100000000,
  "loss_amount_note": "Processed over $100 million in illicit crypto sales and demanded extortion fees up to $20,000 per vendor.",
  "first_seen_at": "2020-10-01T00:00:00Z",
  "last_updated_at": "2026-07-15T12:00:00Z",
  "actor_slug": "incognito-market",
  "defendant_slugs": [
    "rui-siang-siew"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1090",
      "evidence_excerpt": "Operated hidden onion services over the Tor network equipped with automated cryptocurrency escrow mechanisms.",
      "evidence_locator": "Criminal Complaint \u00b6 8, Page 4",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Complaint: U.S. v. Siew",
      "source_url": "https://www.justice.gov/usao-sdny/pr/owner-and-operator-incognito-market-dark-web-narcotics-marketplace-arrested-and-charged",
      "technique_name": "Proxy",
      "tactic": "Command and Control"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2024-05-18",
      "description": "Siew arrested at JFK International Airport in New York upon arrival from Taiwan."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion originating from targeted infiltration directed against Consumer Privacy, Cryptocurrency networks. Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.",
    "blast_radius": "Processed over $100 million in illicit crypto sales and demanded extortion fees up to $20,000 per vendor. Impacted Consumer Privacy, Cryptocurrency infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Infiltration",
        "title": "Perimeter Ingress",
        "description": "Operatives secured access to victim infrastructure within the Consumer Privacy, Cryptocurrency sector.",
        "technical_artifacts": [
          "Network perimeter logs"
        ],
        "mitre_technique_id": "T1190"
      },
      {
        "phase": "Phase 2: Execution",
        "title": "Payload Deployment",
        "description": "Owner and operator of Incognito Market who facilitated over $100 million in illicit darknet transactions before orchestrating an exit scam and extorting registered vendors and buyers with doxxing threats.",
        "technical_artifacts": [
          "Malicious payload"
        ],
        "mitre_technique_id": "T1486"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}