Back Securityaffairs.Co

XSS.is, The Forum That Ran the Ransomware Supply Chain Is Down. The Market Isn’t

Securityaffairs.Co •Pierluigi Paganini • June 30, 2026

Police arrested the alleged admin of XSS.is, a major cybercrime forum whose trusted escrow service helped power the underground economy. On 22 July 2025, French and Ukrainian police arrested a 38-year-old man in Kyiv and shut down XSS.is, the most influential Russian-language cybercrime forum of the past decade. Europol, which coordinated the operation under the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Takedown of XSS.is Forum Disrupts Ransomware Supply Chain On July 22, 2025, French and Ukrainian police arrested the alleged admin of XSS.is, a prominent Russian-language cybercrime forum, effectively shutting it down. This forum was crucial for ransomware operations, facilitating transactions and escrow services within the underground economy. The arrest of the 38-year-old man in Kyiv marks a significant blow to cybercriminal activities, although the broader ransomware market remains active. The XSS.is forum had been a key player in the distribution of ransomware tools and services, impacting numerous organizations globally. Despite this takedown, experts warn that the ransomware market continues to thrive, indicating a resilient underground ecosystem. The operation was coordinated by Europol, highlighting international collaboration in combating cybercrime. The full scope of the impact on ransomware operations is still being assessed as new forums may emerge to fill the void left by XSS.is. 3 sources 53

XSS.is, The Forum That Ran the Ransomware Supply Chain Is Down. The Market Isn’t

The full story

Extracted Entities

Attack Types (1)

Domains (1)