Overview

• The investigation began on July 2, 2021, when Paris prosecutors authorized judicial wiretaps on the ‘thesecure.biz’ XMPP server.
• Intercepted chats uncovered at least $7 million in profits from ransomware and related cybercrimes on XSS.is.
• A subsequent interception pinpointed the alleged administrator and led to French on-site deployments in September 2024.
• Ukrainian police detained the suspect on July 22 at France’s request with assistance from Europol and French officers.
• Authorities now possess evidence that could implicate other forum members and dampen activity on the Russian-speaking platform.