XSS.is, The Forum That Ran the Ransomware Supply Chain Is Down. The Market Isn’t

On 22 July 2025 French and Ukrainian police led Operation Ratatouille, arresting the alleged XSS.is administrator and seizing the forum and an encrypted Jabber server; a leaked XenForo backup and logs revealed XSS’s role as a large Russian‑language escrow marketplace that traded initial access, exploits, malware, stealer logs and credentials which directly supported ransomware intrusions, and analysts measured a median ~19‑day window between access listings and victims surfacing on leak sites — the takedown disrupted a trust hub but the underlying market and access trade persisted.