- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 3,006
Five forums, zero trust and a constant question – which of the moderators works for the FBI.
For two decades, the XSS underground forum has remained one of the main platforms for cybercriminals. They were looking for accomplices, sold accesses, discussing malware, phishing, fraudulent schemes and other illegal services. But after the attack of law enforcement agencies, the site no longer looks like a single center of the underground.
According to Flashpoint, on July 23, 2025, the XSS domain was seized as part of an international operation involving the Ukrainian authorities, the French police and the Europol. The French authorities also reported that a long-time forum administrator was arrested on the territory of Ukraine. After that, the cybercrime community quickly split into several competing platforms.
XSS grew out of the DaMaGeLaB forum and eventually evolved from a mid-range platform into one of the key nodes of the criminal environment. The forum workedloader sellers, phishing kits, malware, botnets for distributed denial of service attacks, forged documents and access to other people's networks. The site also served as a place where employees were hired, looking for partners and resolved disputes between participants.
When the former infrastructure was closed, some of the former moderators launched DamageLib. They found the old XSS compromised and chose a more cautious model. At the new site, trade, auctions and any deals were abandoned in order to reduce the risks of surveillance and tracking of participants. Instead of commerce, DamageLib focused on technical materials, manuals, and discussions.
Another niche was occupied by Rehub, which appeared shortly after DamageLib. It was created by the former moderator XSS, realizing that the participants of the underground still need a platform for transactions. Rehub immediately added the trading section and attracted prominent participants in the criminal environment in order to gain confidence faster. At the same time, the forum is still filled and gaining an active audience.
In early August 2025, another project appeared, which presented itself as a restored XSS on the domain in the .pro zone. Its creators used old backups with user data, topics and content of the forum. However, Exploit and DamageLib met a new version with distrust. Participants suspected that the site could be a trap of law enforcement.
Separately, Flashpoint mentions the XSSF Forum, created by a hacker group in Telegram. This platform declares its goals against the digital infrastructure of the European Union and Ukraine. On the discussions at DamageLib, the forum is not related to XSS. Moreover, direct attacks on the Ukrainian infrastructure contradict the previous rules of the XSS community. The authenticity of the site and the identity of its owners has not yet been confirmed.
The strike on the XSS was a serious success for law enforcement agencies, but did not destroy the cybercrime underground. Instead of a single center, a more fragmented environment arose, where participants migrate between sites, change the rules and re-build confidence. For defenders, such a split does not mean that the threat has decreased. Now we have to follow not one forum, but for a whole network of new and competing communities.
For two decades, the XSS underground forum has remained one of the main platforms for cybercriminals. They were looking for accomplices, sold accesses, discussing malware, phishing, fraudulent schemes and other illegal services. But after the attack of law enforcement agencies, the site no longer looks like a single center of the underground.
According to Flashpoint, on July 23, 2025, the XSS domain was seized as part of an international operation involving the Ukrainian authorities, the French police and the Europol. The French authorities also reported that a long-time forum administrator was arrested on the territory of Ukraine. After that, the cybercrime community quickly split into several competing platforms.
XSS grew out of the DaMaGeLaB forum and eventually evolved from a mid-range platform into one of the key nodes of the criminal environment. The forum workedloader sellers, phishing kits, malware, botnets for distributed denial of service attacks, forged documents and access to other people's networks. The site also served as a place where employees were hired, looking for partners and resolved disputes between participants.
When the former infrastructure was closed, some of the former moderators launched DamageLib. They found the old XSS compromised and chose a more cautious model. At the new site, trade, auctions and any deals were abandoned in order to reduce the risks of surveillance and tracking of participants. Instead of commerce, DamageLib focused on technical materials, manuals, and discussions.
Another niche was occupied by Rehub, which appeared shortly after DamageLib. It was created by the former moderator XSS, realizing that the participants of the underground still need a platform for transactions. Rehub immediately added the trading section and attracted prominent participants in the criminal environment in order to gain confidence faster. At the same time, the forum is still filled and gaining an active audience.
In early August 2025, another project appeared, which presented itself as a restored XSS on the domain in the .pro zone. Its creators used old backups with user data, topics and content of the forum. However, Exploit and DamageLib met a new version with distrust. Participants suspected that the site could be a trap of law enforcement.
Separately, Flashpoint mentions the XSSF Forum, created by a hacker group in Telegram. This platform declares its goals against the digital infrastructure of the European Union and Ukraine. On the discussions at DamageLib, the forum is not related to XSS. Moreover, direct attacks on the Ukrainian infrastructure contradict the previous rules of the XSS community. The authenticity of the site and the identity of its owners has not yet been confirmed.
The strike on the XSS was a serious success for law enforcement agencies, but did not destroy the cybercrime underground. Instead of a single center, a more fragmented environment arose, where participants migrate between sites, change the rules and re-build confidence. For defenders, such a split does not mean that the threat has decreased. Now we have to follow not one forum, but for a whole network of new and competing communities.
