Loading story…
A leaked historical archive of the Russian-language cybercrime forum Exploit.in, covering February 2005 to May 2008, documents early structures that foreshadowed the modern ransomware economy. The dataset contains 9,647 accounts, 13,925 threads, and 80,891 posts, with a small group of prolific members driving much of the activity. Its private access levels, reputation mechanisms, and trade in compromised shells and network access resemble present-day affiliate vetting, escrow arrangements, and initial-access-broker markets.
Researcher Dancho Danchev identified 205 distinctive handles appearing both on Exploit.in and in private-message archives from five later criminal forums, including XSS, RAMP, and BreachForums, indicating possible long-term social and operational continuity. The evidence does not establish that identically named accounts belonged to the same individuals, and identities were not published because the archive contains sensitive personal information for thousands of users.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
A database dump records Exploit.in activity from February 2005 through May 2008, including markets and discussions involving malware, botnets, shells, stolen cards, spam, and vulnerability testing. The dump contains 9,647 accounts, 13,925 threads, and 80,891 posts.
Dancho Danchev cross-referenced Exploit.in usernames with private-message archives from five later forums, identifying 205 distinctive overlapping handles after excluding generic names. The analysis cautioned that matching handles do not establish that the same individuals operated both accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked MySQL database from the **RAMP** cybercrime forum has exposed the inner workings of a major Russia-linked ransomware marketplace, while separate reporting says the **FBI later seized the forum**. Analysis of the leak showed RAMP operated from November 2021 through January 2024 as a commercial hub for the full ransomware supply chain, connecting initial access brokers, ransomware-as-a-service (**RaaS**) operators, and affiliates through public listings and private negotiations. The dataset reportedly contained **7,707 users**, **1,732 threads**, **340,333 IP log records**, **1,899 private conversations**, and **3,875 private messages**, revealing **333 access-sale threads** and **60 RaaS threads**. Listings targeted organizations in more than 20 countries, with the **United States** appearing in about **40%** of identifiable offers, and victims spanning government, banking, healthcare, energy, technology, defense, and telecommunications. The records showed affiliates could receive up to **90%** of ransom proceeds, underscoring how ransomware campaigns were sustained by a specialized underground market built around stolen access, affiliate recruitment, and private deal-making.
Jun 29, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
Leaked internal communications from the Conti ransomware operation exposed one of the clearest views yet into a major cybercrime enterprise run like a legitimate technology company. Material published beginning on 27 February 2022 after Conti publicly backed Russia included tens of thousands of Jabber messages, source code, infrastructure details, operational guidance, and translated archives shared through public repositories. The leaks showed Conti had structured management, HR, developers, testers, recruiters, support staff, payroll, and defined working practices, with some reporting describing roughly 150 members and others documenting more than 160,000 messages among nearly 500 actors tied to Conti and related operations. Researchers said the disclosures revealed a mature ransomware-as-a-service and double-extortion business that had already become one of the most damaging strains globally, with the FBI previously linking Conti to more than 1,000 victims and over $150 million in victim payments by early 2022. The leaked chats also mapped Conti’s wider ecosystem, showing overlap with TrickBot, BazarLoader, Ryuk, LockBit, Maze, Ragnar Locker, Emotet, IcedID, Buer, Amadey, and other malware operations, while indicating the group often avoided Russian and Chinese targets and may have had links to Russian state interests. Analysts said the disclosures uncovered victim-selection methods, attack infrastructure, salaries, and collaboration patterns, while also creating a proliferation risk by giving other criminals access to Conti tradecraft and code. Despite the exposure, reporting indicated the group continued operations, adapted its tooling and intrusion methods, and may have influenced or re-emerged through later activity such as Monti, underscoring that the leak disrupted secrecy more than it ended the threat.
Aug 15, 2026