On July 22, 2025, a 38-year-old man was arrested in Kyiv during a long-running investigation led by French law enforcement and coordinated by Europol. He is suspected of serving as the administrator of XSS, a prominent Russian-language cybercrime forum with over 50,000 members. As a trusted intermediary on the forum, he allegedly mediated disputes and ensured the security of illicit transactions among cybercriminals involved in groups like REvil, LockBit, Conti, and Qiliin.

The individual’s identity has not been officially confirmed, but many members of the underground community believe he is the well-known hacker known by the alias "Toha," a figure with nearly two decades of activity in the cybercrime ecosystem. Toha’s history includes founding major Russian-speaking forums such as Hack-All in the early 2000s, which later evolved into the influential platform Exploit.in. Since the arrest, all known online accounts associated with Toha have gone silent.

‍

Source: https://krebsonsecurity.com/2025/08/who-got-arrested-in-the-raid-on-the-xss-crime-forum/