Mastermind behind Russian-speaking cybercrime hub arrested in Ukraine

The suspected administrator of xss.is, one of the world’s most influential Russian-speaking cybercrime forums, was arrested in Kyiv, Ukraine, on 22 July. The takedown followed a long-running investigation led by the French Police and Paris Prosecutor, in close cooperation with Ukrainian authorities and Europol.

With over 50,000 registered users, xss.is functioned as a major marketplace for stolen data, hacking tools and illicit services. It played a central role in facilitating, advertising, and recruiting for some of the most active and dangerous cybercriminal networks.

The arrest was part of a series of coordinated enforcement actions aimed at collecting evidence and dismantling the forum’s underlying criminal infrastructure.

The forum’s administrator is believed to have played a central role in enabling criminal activity. As a trusted intermediary, he mediated disputes between criminals and ensured the security of their transactions. He is also suspected of operating thesecure.biz, a private messaging platform designed specifically for the cybercriminal underground.

Through these services, the suspect is thought to have earned over €7 million in advertising and facilitation fees. Investigators believe he has been active in the cybercrime ecosystem for nearly 20 years, maintaining close ties with several major threat actors throughout that time.