Europol: key figure behind major Russian-speaking cybercrime forum arrested in Ukraine
A long-running investigation led by the French Police and Paris Prosecutor, in close cooperation with their Ukrainian counterpart and Europol, has led to the arrest of the suspected administrator of xss.is, one of the world’s most influential Russian-speaking cybercrime platforms. The arrest took place in Kyiv, Ukraine, on 22 July.
The forum, which had more than 50,000 registered users, served as a key marketplace for stolen data, hacking tools and illicit services. It has long been a central platform for some of the most active and dangerous cybercriminal networks, used to coordinate, advertise and recruit.
According to Europol, the forum’s administrator was not only a technical operator but is believed to have played a central role in enabling criminal activity. Acting as a trusted third party, he arbitrated disputes between criminals, and guaranteed the security of transactions. He is also believed to have run thesecure.biz, a private messaging service tailored to the needs of the cybercriminal underground.
Through these services, the suspect is thought to have made over €7 million in advertising and facilitation fees. Investigators believe he has been active in the cybercrime ecosystem for nearly two decades, and maintained close ties to several major threat actors over the years.
The investigation was initiated by the French Police in 2021. In September 2024, the case moved into the operational phase in Ukraine, where French police investigators were deployed on the ground. Europol provided essential operational and analytical support throughout the investigation, facilitating information exchange and coordination between the French Police and Ukrainian authorities and assisted in mapping the cybercriminal infrastructure and linking the suspect to other major threat actors.
During this week’s enforcement actions in Kyiv, a Europol mobile office was deployed to support French and Ukrainian teams with on-site coordination and evidence collection. The seized data will now be analysed to support ongoing investigations across Europe and beyond.
Find out more
MOST READ
[popular_posts columns_xl=”4″ columns_l=”4″ columns_m=”3″]
