Admin or Not? Suspect Linked to Major XSS Forum Arrested in Kyiv
The forum operated in the shadows since 2013 — now investigators are lining up behind it.
The forum operated in the shadows since 2013 — now investigators are lining up behind it.
The Paris Prosecutor’s Office has announced the arrest of a suspected administrator of the Russian-language cybercrime forum XSS.is, known as one of the largest underground platforms in the cybercriminal world. The operation took place on July 22 with the involvement of Ukrainian law enforcement, French investigators, and Europol.
According to the prosecutors, since 2013 XSS.is served as a major hub for the distribution of malware, trade in compromised system access, stolen data, and services linked to ransomware operations. Communications between forum members were conducted via the encrypted Jabber messenger thesecure.biz.
Timeline of the Investigation:
- July 2, 2021: The first phase of the investigation was launched by the Paris Cybercrime Unit and handed over to the BL2C (Brigade de Lutte Contre la Cybercriminalité) under the police prefecture. Investigators intercepted message traffic from the thesecure.biz server as part of a judicial inquiry. Analysis confirmed user involvement in ransomware operations, with total damages estimated at at least $7 million.
- November 9, 2021: A second criminal case was opened under charges of hacking automated systems, extortion as part of an organized group, and criminal conspiracy.
Arrest in Kyiv:
Authorities were able to identify the alleged administrator during the second investigation. He was arrested on July 22 in Kyiv, with the Ukrainian Cyber Police, SBU, and the General Prosecutor's Office participating. French investigators were present on the ground, and coordination was handled by Europol.
The Paris Prosecutor’s Office confirms that the investigation is still ongoing.
