Loading story…
French and Ukrainian law enforcement, supported by Europol in Operation Ratatouille, dismantled XSS.is, a major Russian-language cybercrime forum, and arrested its alleged 38-year-old administrator in Kyiv. Authorities also seized the associated thesecure.biz Jabber server and other infrastructure used to support transactions among malware developers, exploit sellers, spammers, initial access brokers, and ransomware affiliates. Investigators said the forum had operated for nearly 20 years, amassed more than 50,000 members, and generated more than EUR 7 million for the suspect through escrow services.
The takedown hit what researchers described as a key trust and escrow layer in the cybercrime supply chain rather than a simple discussion board. Analysis of leaked XSS.is data and access telemetry indicated a predominantly Russian-speaking user base centered in the CIS region, with heavy activity around web vulnerabilities, malware, exploit kits, crypting, and sales of shells, databases, and RDP access. Although the forum briefly resurfaced on a new Tor address, trust reportedly collapsed after balances were wiped and moderators disappeared, while activity shifted to other forums including RAMP and DarkForums; investigators are now positioned to mine seized forum, database, and messaging data to correlate aliases, emails, IP addresses, and other identifiers across the underground ecosystem.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
After the takedown, XSS.is briefly resurfaced on a new Tor address. Trust in the forum quickly eroded as user balances were wiped and moderators were removed, driving activity toward other forums such as RAMP and DarkForums.
French and Ukrainian law enforcement, coordinated by Europol under Operation Ratatouille, disrupted the Russian-language cybercrime forum XSS.is and arrested its alleged administrator, a 38-year-old man, in Kyiv. Authorities also seized supporting infrastructure including the associated thesecure.biz Jabber server.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. law enforcement has **seized the RAMP cybercrime forum**, a long-running hub used to advertise and facilitate ransomware operations, malware distribution, and other illicit services. Both the forum’s Tor presence and clearnet domain (reported as `ramp4u[.]io`) were replaced with an FBI seizure banner indicating coordination with the U.S. Attorney’s Office for the Southern District of Florida and the DOJ’s Computer Crime and Intellectual Property Section; the forum’s administrator reportedly acknowledged the takedown publicly on the XSS forum. Reporting notes RAMP emerged as a dedicated venue for ransomware promotion after other major forums restricted such activity, and that criminal communities are already attempting to migrate to alternative platforms. Separate reporting also highlighted other cybercrime enforcement actions (including indictments tied to **Ploutus**-based ATM jackpotting and other marketplace disruptions), but those are distinct from the RAMP seizure. A different, unrelated incident involved a **supply-chain compromise of eScan antivirus** update infrastructure in which attackers briefly pushed a backdoor via a trojanized `Reload.exe` that altered update settings, established persistence via a scheduled task, and contacted a C2 to retrieve additional payloads; this event is not connected to the RAMP takedown and should be tracked independently as a vendor update-channel compromise affecting customer environments.
Jun 29, 2026
US law enforcement seized the **RAMP (Russian Anonymous Marketplace)** cybercrime forum’s infrastructure, taking over both its Tor and clearnet presence and replacing them with a “This Site Has Been Seized” banner attributed to the **FBI**, coordinated with the **US Attorney’s Office for the Southern District of Florida** and the DOJ’s **Computer Crime and Intellectual Property Section (CCIPS)**. RAMP was a key marketplace for **ransomware-as-a-service (RaaS)** promotion and related criminal services, including activity by extortionists and **initial access brokers**; the seizure banner also taunted operators with the forum’s slogan, “**THE ONLY PLACE RANSOMWARE ALLOWED!**,” alongside an image of *Masha* from the Russian children’s cartoon. While authorities had not publicly detailed the operation at the time of reporting, technical indicators supported the takeover, including DNS changes consistent with prior FBI seizures (e.g., nameservers set to `ns1.fbi.seized.gov` / `ns2.fbi.seized.gov`). Reporting also cited an alleged operator (“**Stallman**”) acknowledging law enforcement control, and noted the seizure could expose forum user data (e.g., email addresses, IP addresses, and private messages), increasing identification and arrest risk for actors with poor OPSEC. Background context indicates RAMP emerged after other Russian-language forums restricted ransomware promotion under increased law-enforcement pressure.
Jun 29, 2026
An international law-enforcement operation involving the **FBI**, **Europol**, and authorities across **14 countries** seized infrastructure used by **LeakBase**, a major cybercrime marketplace/forum used to trade stolen data, exploits, and hacking services. Investigators reportedly seized LeakBase domains, displayed seizure banners, executed search warrants, and made arrests; forum data (including user accounts, messages, and IP logs) was preserved to support follow-on investigations and deterrence efforts. Separate reporting in the same news cycle described other unrelated cyber developments, including Europol-led disruption of the **Tycoon2FA** phishing-as-a-service platform (used for adversary-in-the-middle MFA bypass), a guilty plea tied to the **Phobos** ransomware operation, a newly documented China-linked espionage cluster (**CL-UNK-1068**) targeting critical sectors in Asia, an unverified **ShinyHunters** extortion claim against *Woflow*, suspected DPRK-linked intrusions against cryptocurrency firms, and a pro-Iranian/pro-Palestinian ransomware ecosystem shift from **Sicarii** to **BQTLock**. Those items do not materially change the core LeakBase takedown but indicate continued pressure on cybercrime infrastructure alongside ongoing ransomware and espionage activity.
Jun 29, 2026