In short
- U.S. Department of Justice states Kutleshi was arrested by Kosovo law enforcement in December 2024 and extradited to the United States in 2025.
- U.S. Department of Justice confirms the domain www.Rydox.cc was judicially seized in December 2024, preventing further cybercrime activity.
What happened
Ardit Kutleshi, a Kosovar national, admitted to creating and running Rydox, an illicit cybercrime marketplace that enabled the sale of stolen personal information and access devices. The site facilitated over 7,600 transactions and generated at least $232,000 in revenue from cybercriminals purchasing tools and data.
Kutleshi was arrested by Kosovo law enforcement in December 2024 and extradited to the United States in 2025. The U.S. Department of Justice judicially seized the domain www.Rydox.cc in December 2024, effectively shutting down the marketplace and preventing further illegal activity.
According to court documents, since at least 2016, Rydox conducted over 7,600 transactions involving stolen personally identifiable information (PII), stolen access devices, means of identification, and cybercrime tools and services, receiving at least $232,000 in revenue.
In numbers
- 7,600 Number of Rydox transactions
- $232,000 Revenue generated by Rydox
Named in this item
What compliance teams should check
- Review customer and transaction records for links to Rydox or www.Rydox.cc, especially involving stolen PII or access devices.
- Update screening lists to include Ardit Kutleshi and Jetmir Kutleshi as convicted cybercriminals per U.S. Department of Justice court documents.
- Monitor for typologies involving marketplaces with over 7,600 transactions and revenue of at least $232,000, as described in the Rydox case.
Why it matters
This case highlights the risks posed by cybercrime marketplaces like Rydox, which facilitate large-scale trading of stolen personal information and access devices. The guilty plea and domain seizure demonstrate the effectiveness of international cooperation and law enforcement in disrupting such platforms. Compliance officers must remain vigilant for similar schemes, update screening lists, and monitor for typologies involving high-volume illicit transactions, as these platforms can significantly impact financial institutions and their customers through identity theft and fraud.
Catch stories like these on your own customers.
complead screens your customers against adverse media, sanctions and PEP lists, and re-checks them every day. When a name you hold turns up in the news, it lands in your case queue with the evidence attached.