French authorities announced on Wednesday that an alleged administrator of the XSS.is cybercrime forum has been arrested in Ukraine.
The suspect has not been named and Ukrainian police have yet to issue a statement on the matter.
According to the Public Prosecutor’s Office in Paris, the individual was arrested on July 22 as part of an investigation launched four years ago. The arrest took place in the presence of French police, which received assistance from Europol.
The investigation targeted a Jabber server named ‘thesecure.biz’, which the XSS forum used to facilitate anonymous communications between members.
French police intercepted messages, which brought to light activities that generated at least €7 million ($8.4 million) in profits for the suspect, mainly from advertising and facilitation fees, according to Europol.
“The forum’s administrator was not only a technical operator but is believed to have played a central role in enabling criminal activity,” Europol said. “Acting as a trusted third party, he arbitrated disputes between criminals and guaranteed the security of transactions. He is also believed to have run thesecure.biz, a private messaging service tailored to the needs of the cybercriminal underground.”
“Investigators believe he has been active in the cybercrime ecosystem for nearly two decades, and maintained close ties to several major threat actors over the years,” the law enforcement agency added.
XSS is a Russian-language cybercrime forum that has been around for more than a decade — two decades if we count an earlier version named DaMaGeLaB.
The website has been used by its 50,000 members to buy and sell ransomware and other malware, access to compromised systems, stolen data, and zero-days and other exploits. It has also been used to leak data stolen in high-profile hacks.
Threat intelligence company KELA pointed out that it’s unclear if the suspect arrested in Ukraine is the individual behind the ‘admin’ online moniker, which seems to belong to the owner and administrator of XSS. The forum’s users pointed out that ‘admin’ had not been online since July 22.
Earlier this year, French authorities arrested a 25-year-old British national believed to be the notorious hacker known as IntelBroker. He is facing extradition to the United States, where he has been charged over his alleged cybercriminal activities.
UPDATE, July 25, 2025: The XSS website is now displaying a screen informing visitors that it has been seized.
*article updated throughout with new information from Europol and KELA
Related: France Blames Russia for Cyberattacks on Dozen Entities
Related: 13 Romanians Arrested for Phishing the UK’s Tax Service
Related: Armenian Man Extradited to US Over Ryuk Ransomware Attacks
