US Indicts Iranian National for Operating Nemesis Darknet Marketplace

A US grand jury has charged Iranian national Behrouz Parsarad for operating the Nemesis darknet marketplace, which between 2021 and 2024 facilitated the sale of illicit cyberservices and drugs.

The indictment alleges that Parsarad founded Nemesis in March 2021, and that the marketplace grew to serve more than 150,000 users and register around 1,100 vendor accounts worldwide.

Nemesis allegedly processed over 400,000 orders between its launch and March 2024, when U.S., German and Lithuanian authorities seized its servers and shut it down.

55,000 of these orders—or 13.75% of the total—were for stimulants such as methamphetamine and cocaine, while 17,000 (4.25%) were for opioids such as heroin and fentanyl.

Iranian National Indicted for Operating Online Marketplace Offering Fentanyl and Money Laundering Services

Nemesis Market Processed Over 400,000 Orders

🔗: https://t.co/WfW2QsnnuV pic.twitter.com/u0iKL2enrs

— Criminal Division (@DOJCrimDiv) April 18, 2025

Speaking in a press release, Matthew R. Galeotti, Head of the Justice Department’s Criminal Division, said, “The allegations in this indictment span over four hundred thousand transactions involving fentanyl, other dangerous drugs, and a wide range of contraband made accessible on the darknet for more than three years.”

In addition to dealing in prohibited materials, the indictment also charges Parsarad with offering money laundering services, with Nemesis used to mix the cryptocurrencies used to pay for goods and services.

U.S. sanctions

In March of this year, U.S. officials placed sanctions on Parsarad, who reportedly collected a percentage of every sale transacted on Nemesis’s platform.

The platform had processed almost $30 million in drug sales prior to its closure last year, amid a backdrop of rising opioid abuse in the U.S., where deaths from fentanyl almost tripled between 2016 and 2021.

Parsarad faces a mandatory minimum penalty of 10 years in prison and a maximum life sentence, with DoJ Trial Attorney Gaelin Bernstein and Assistant U.S. Attorney Segev Phillips for the Northern District of Ohio prosecuting the case.

The accused Nemesis operator currently resides in Iran, with which the United States does not have an extradition treaty.

He may therefore escape justice, with Parsad having discussed setting up a replacement for Nemesis, according to the U.S. Department of the Treasury’s Office of Foreign Assets Control.

At the same time, no other individual has been charged or arrested in connection with the operation of Nemesis.

For some security experts, this could be considered surprising, insofar as Parsarad would likely have needed help to operate a marketplace the size of Nemesis.

“While one person can register infrastructure or oversee a platform’s setup, a darknet marketplace of Nemesis’s size typically requires a broader operational team,” said Ari Redbord, the Head of Legal and Government Affairs at blockchain intelligence firm TRM Labs.

Speaking to Decrypt, Redbord explained that collaborators may have included administrators, moderators, escrow agents, technical developers and “money laundering facilitators.”

He added, “As seen in prior takedowns (e.g., AlphaBay or Hydra), these platforms often involve distributed teams with clearly defined roles to ensure uptime, user trust, dispute resolution, and secure cash-out mechanisms.”

So while the Department of Justice has used the indictment to highlight, in Matthew Galeotti’s words, its commitment “to protecting U.S. communities from the harms caused by fentanyl and darknet marketplaces,” there still remains an ongoing risk of such harms.

Darknet marketplaces around the world

This is particularly the case when, according to TRM Labs, a significant number of darknet marketplaces are still in operation.

“As of today, TRM assesses that approximately 20 to 30 significant drug-focused DNMs are active at any given time,” Redbord told Decrypt. “This number has remained relatively stable over the years due to risk, profitability, and law enforcement pressure.”

What’s significant about this estimate is that it covers only “drug-focused” darknet markets (DNMs), with TRM Labs using a definition of DNMs that excludes marketplaces that trade only in illicit cyberservices.

According to Redbord, the typical lifespan of a drug-focused DNM is around two to three years, at which point it’s either abandoned or shut down.

These marketplaces generally fall into two major ecosystems, Russian and Western.

Redbord explained, “The Russian-language DNM ecosystem, built around dead-drop delivery methods, is the largest, with 4–5 dominant platforms and several smaller ones operating mainly within Russia and the ex-Soviet space.”

He added that Russian-based DNMs such as Blacksprut and Kraken Market generate “substantial profits,” are technologically advanced, and have become “deeply embedded” in regional drug economies.

In contrast, Western, English-based DNMs—such as Abacus Market and STYX Market—“are smaller but more resilient,” relying on postal delivery systems and operating more internationally.

Source