This operation underscores the increasing cooperation among French, European, and international law enforcement agencies in response to rising cyber threats, including recent attacks on public and private sectors.

A major crackdown on cybercrime has led to the arrest of the suspected administrator of the notorious XSS.is forum, a platform that facilitated the sale of stolen data, hacking tools, and illicit services, generating over 7 million euros for its operator.

The arrest was carried out on July 22, 2025, through a coordinated effort involving Ukrainian authorities, French police, and Europol, marking a significant step in international cybercrime enforcement.

This operation was part of a long-term investigation initiated by the Paris public prosecutor's office in 2021, which utilized wiretaps and monitored encrypted communications on a Jabber server called thesecure.biz.

Europol played a crucial role by providing operational and analytical support, helping to map the criminal network, and seizing user data that is now being analyzed to track other cybercriminals.

Following the arrest, law enforcement seized the XSS.is domain, which now displays a seizure notice, and the forum's infrastructure has been dismantled to prevent further illicit activities.

The suspect, known by the pseudonym 'toha,' is believed to have acted as a central figure, mediating deals, resolving disputes, and securing transactions within the forum, which had over 50,000 users.

XSS.is, active since 2013 and originally named DaMaGeLab, was a key player in global cybercrime, facilitating anonymous communication among criminals and operating via a Jabber server.

The investigation revealed numerous illicit activities, including ransomware and organized cyberattacks, with intercepted messages indicating widespread criminal operations.

This crackdown follows recent arrests of cybercriminal operators, including those involved with BreachForum, highlighting a broader effort to combat cybercrime across Europe.

Authorities emphasize that such arrests demonstrate that cybercriminals will eventually be caught, and ongoing investigations aim to dismantle the entire infrastructure of these illegal platforms.

The seized data from the forum will support ongoing investigations by providing valuable insights into the network of cybercriminals and their activities.