Who got arrested in the raid on the XSS crime forum?(krebsonsecurity.com)
krebsonsecurity.com
Who got arrested in the raid on the XSS crime forum?
https://krebsonsecurity.com/2025/08/who-got-arrested-in-the-raid-on-the-xss-crime-forum/
41 comments
Seems suspicious that part of the identity tracing chain is a sale to a user named "Honeypo" (honeypot).
The article says that that post was likely a fake post created by Toha to throw off authorities:
>It seems plausible that the BMW ad invoking Toha’s email address and the name and phone number of a Russian citizen was simply misdirection on Toha’s part — intended to confuse and throw off investigators.
>It seems plausible that the BMW ad invoking Toha’s email address and the name and phone number of a Russian citizen was simply misdirection on Toha’s part — intended to confuse and throw off investigators.
No it’s to do with censorship of Pooh in china.
A 38-year-old Russian crime gang leader arrested in ... Kyiv, Ukraine.
"The law enforcement action and resulting confusion about the identity of the detained has thrown the Russian cybercrime forum scene into disarray in recent weeks"
I'm guessing "disarray" means payments not posting? Bonus pool depleted?
"The law enforcement action and resulting confusion about the identity of the detained has thrown the Russian cybercrime forum scene into disarray in recent weeks"
I'm guessing "disarray" means payments not posting? Bonus pool depleted?
> A 38-year-old Russian crime gang leader arrested in ... Kyiv, Ukraine.
That tracks. How many Russian cybercriminals can you think of who were arrested in Russia? Hence why a lot of malware checks for your keyboard's language - so the payload doesn't deploy in Russia, which _would_ actually get you arrested.
But if you're targeting people outside Russia, you're golden.
As for why he's in Kyiv? Maybe his girlfriend is from there. Maybe he prefers Kyiv to Moscow or whichever oblast he's from. Maybe he's hiding from the Russian draft?
That tracks. How many Russian cybercriminals can you think of who were arrested in Russia? Hence why a lot of malware checks for your keyboard's language - so the payload doesn't deploy in Russia, which _would_ actually get you arrested.
But if you're targeting people outside Russia, you're golden.
As for why he's in Kyiv? Maybe his girlfriend is from there. Maybe he prefers Kyiv to Moscow or whichever oblast he's from. Maybe he's hiding from the Russian draft?
> Russian crime gang leader arrested in ... Kyiv,
It's funny how all Ukrainian criminals are Russians. /s
It's funny how all Ukrainian criminals are Russians. /s
there is a difference between "russian" and "russian speaking" that is quite important to many eastern europeans that do not wish to be part of some kreml lead lingua-nation.
> It's funny how all Ukrainian criminals are Russians. /s
I'm in Poland atm : it's funny how all criminals in Poland are Ukrainians /s
(fwiw my mom is from Ukrainian roots and has one of those family names ending in "-enko" so chill out guys)
Seriously though: lots of car theft here in Poland are cars being stolen and finding their way to Ukraine (and some to Russia).
I'm in Poland atm : it's funny how all criminals in Poland are Ukrainians /s
(fwiw my mom is from Ukrainian roots and has one of those family names ending in "-enko" so chill out guys)
Seriously though: lots of car theft here in Poland are cars being stolen and finding their way to Ukraine (and some to Russia).
Etheryte(4)
Why would cyber-criminals (successful ones at least) dare living in Europe? Aren't there plenty of places out of reach for Europol and the FBI, etc.?
Or is cyber-crime so unprofitable?
Or is cyber-crime so unprofitable?
I assume they just continue living where they lived before?
> Aren't there plenty of places out of reach for Europol and the FBI, etc.?
There are a few problems with this question, but lets start with
Where is "out of reach for Europol and the FBI"?
There are a few problems with this question, but lets start with
Where is "out of reach for Europol and the FBI"?
I mean I rarely read that they nab anyone outside of Europe/the US. But would have assumed the middle east, south east asia, post-soviet republics. If this guy is Russian speaking why not Russia?
... and it's 403 error from Tor. And no .onion site. LOL
> Since the Europol announcement, the XSS forum resurfaced at a new address on the deep web (reachable only via the anonymity network Tor).
Should it not rather be "the dark web"?
Should it not rather be "the dark web"?
The “dark web” is a journalistic (AFAICT) coinage arising from a confusion between two terms: a “darknet” (antonym: “clearnet”) is a network that traverses the Internet in such a way that the Internet’s routing infrastructure can’t see the ultimate destination (Tor, but also DN42, your work VPN, etc.); the “deep web” is the part of the web that’s not accessible to search engines and thus only really used by those who already know it exists (Tor hidden services, pirate libraries, private torrent trackers, but also every other registration-gated forum and arguably even Facebook Marketplace—the term is from a more innocent time with much fewer walled gardens).