Administrator of Major Dark Web Cybercrime Forum Arrested In Ukraine

alternative_right shares a report from France 24: A suspected administrator of a top Russian-language cybercrime forum, XSS.is, has been arrested in Ukraine with the help of French police and Europol, French prosecutors said on Wednesday. Industry experts describe XSS.is as one of the longest-running dark web forums. "On Tuesday July 22, a person suspected of being the administrator of the Russian-language cybercrime forum XSS.is was arrested as part of a criminal investigation opened by the Paris public prosecutor's office," Paris prosecutor Laure Beccuau said in a statement. "Active since 2013, this forum was one of the main hubs for global cybercrime. The forum also operated an encrypted Jabber messaging server, facilitating anonymous exchanges between cybercriminals."

"A judicial investigation was opened on November 9, 2021 on charges of complicity in attacks on an automated data processing system, organised extortion, and criminal conspiracy," Beccuau said. "The intercepted messages revealed numerous illicit activities related to cybercrime and ransomware, and established that they generated at least $7 million in profits."

Read more of this story at Slashdot.

iptables -A INPUT -j DROP && iptables -A OUTPUT -j DROP

Reset-ADAccountPassword -Identity krbtgt

winpmem.exe -o memdump.raw / dd if=/dev/fmem of=mem.raw

Verify WORM-Storage Lock status

title: Detect Exploitation - Administrator of Major Dark Web Cybercrime Forum Arrested In Ukraine
id: 3f818fc6-15de-4acf-901b-1c69afceefbf
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1486

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Administrator of Major Dark We" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Administrator of Major Dark Web Cybercri")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Administrator of Major Dark Web Cybercri*"

CommonSecurityLog
| where Message has "Administrator of Major Dark Web Cybercri"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc