ZeroFox Intelligence Flash Report - Major Cybercrime Forum Disrupted by Law Enforcement

ZeroFox Intelligence Flash Report - Major Cybercrime Forum Disrupted by Law Enforcement

Product Serial: F-2025-07-24b

TLP:CLEAR

In this Flash report, ZeroFox researchers report on a recently-announced law enforcement operation that resulted in the disruption of a prominent cybercrime forum, as well as the arrest of an allegedly affiliated individual.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On July 23, 2025, prominent deep web forum XSS went offline; its associated web domain, xss[.]is, is currently displaying an announcement about the forum's seizure by multiple law enforcement (LE) entities.
• The forum outage follows an announcement by the same LE bodies about the arrest of an individual suspected of fulfilling an administrative role within XSS. Reporting suggests that the arrest, which took place in Ukraine, is part of an LE operation that commenced in 2021.
• While the arrest of the alleged deep web forum moderator does not itself allude to long-term disruption of the xss[.]is forum, there is a likely chance that subsequently obtained information will lead to the identification of additional individuals involved in operating the XSS forum, as well as the acquisition of critical digital infrastructure by LE.