Analyst1

[RIP RAMP – Part 3: Stallman] Wazawaka, Kajit, Stallman and what each of these figures represented in the broader evolution of Russian cybercrime 📌 If I had to describe the current mood across Russian darknet forums, it would be fingers pointing in every direction. Along with that comes a growing realization: many forum members may have been nothing more than participants in a very large honeypot built by law enforcement with Stallman sitting at its center. 📌 Throughout the history of Russian-speaking forums, platforms collapse, get seized, or quietly disappear and new ones emerge in their place. Yet across many of them, one constant remains: Stallman. 📌 In underground circles, Stallman is known as a highly experienced figure, someone who “knows how things are done.” In the Russian-speaking forum ecosystem, where stable leadership is a defining characteristic, a leader is seen not merely as someone in charge, but as a custodian of group identity. Stallman seemed to fill this role perfectly. 📌 Stallman’s public and primary activity across forums was as a buyer of accesses. “I will buy your accesses, mostly interested in the US and Europe,” he posted during the early days of RAMP’s launch. 📌 Stallman joined RAMP in the first months after its launch and quickly became part of the inner circle. In November 2021, Kajit confirmed that Stallman had officially taken on the role of guarantor. In practice, this meant that access sales would go through him — clever indeed. 📌 Staying true to his “caretaker” image, Stallman promised that RAMP’s security would be held to the highest standard. The $500 registration fee, he said, would go toward exactly that. 📌 As discussions unfolded after the RAMP takedown and more information spilled out, cracks began to show. While Stallman did act as a guarantor, not all community members felt those deals were handled honestly. Some users now claim they were misled or tricked, suggesting that Stallman may have pursued personal gain rather than acting as the neutral guarantor meant to keep the peace. The current status of Stallman? Banned. 📌 Whether the Stallman persona(s) will reappear under a different moniker(s) to serve the same master(s) remains an open question. But the official Stallman era appears to be over. And not just Stallman’s era. What matters more is what this says about the broader phase Russian-speaking cybercrime is entering. We are witnessing total distrust within an ecosystem that existed for more than 20 years. That trust began visibly eroding after the REvil crackdown in 2021 and intensified further with the takedown of XSS last year. The fall of RAMP may have been the final break. 📌 Of course, this is not the end. The void will be filled, and a new “leader” will be announced. Because this is no longer cyclical — it’s structural. Roles are assigned, and actors will continue to play them. Get ready for the second act - REhub/DragonHub 🐲 @Analyst1 🦅

[RIP RAMP – Part 1: Wazawaka] Wazawaka, Kajit, Stallman and their roles in the broader evolution of Russian DarkWeb forums. 📌 On January 28, 2025, the RAMP forum went dark under a seizure banner crediting multiple agencies. RAMP is a stark case study in the evolution of ransomware and Russian cybercrime. From its birth in 2021 and through what it grew into, RAMP mirrored the broader trajectory of the Russian cybercrime. 📌 RAMP was launched on July 11, 2021, by Mikhail Matveev. At first, he operated briefly under the moniker TetyaSluha (his sense of humor was always particular), before switching to Orange. The timing of the project also aligned with an ongoing conflict between Matveev and his former Babuk ransomware partner, dyadka0220. 📌 Following the division of assets, dyadka0220 retained the Babuk source code, which was later leaked in September 2021. Matveev, meanwhile, ended up with the Babuk domain and it was on that foundation that the first version of RAMP was launched. 📌 For Matveev, RAMP was a personal and sacred project — one where, in his own words, he “poured his heart.” A master manipulator obsessed with Western media attention, his long-running feud with journalists and researchers became part of the forum’s identity. 📌 “RAMP is the result of my year-long work of manipulation of top journalists and media such as Bloomberg and others. I declare this forum is a work of art!”, he wrote this in one of his earliest messages. 📌 The launch of RAMP and its rapid popularity, gaining nearly 400 users within the first ten days was driven largely by a critical shift elsewhere: ransomware discussion had recently been banned on XSS, one of the main Russian-speaking cybercrime forums at the time. RAMP filled that vacuum immediately. 📌 The year 2021 was a defining moment for ransomware, setting the tone for what the next five years would become and what the landscape remains today. A major turning point came on June 16, 2021, when U.S. President Joseph Biden and Russian President Vladimir Putin met in Geneva. Ransomware became one of the topics raised, marking cybercrime not simply as criminal activity, but as an issue of geopolitical consequence. 📌 We know what followed: the REvil crackdown, arrests, and increasing pressure on cybercriminals inside Russia, likely as leverage for negotiations that ultimately went nowhere, especially after the invasion of Ukraine in February 2022. 📌 After banning of ransomware on XSS, Matveev and his RAMP gained momentum. However, these were also his last months of public anonymity. In January 2022, he was publicly deanonymized by Brian Krebs. 📌 What Matveev represented and what the launch of RAMP signaled may have been one of the last snapshots of Russian cybercriminals operating in a relatively organic underground. Before law enforcement pressure became more visible. Before forums became more orchestrated, curated, and controlled. Stay Tuned for Part Two — the story of Kajit. @Analyst1 🦅

📌 [New Report] Infrastructure in the Shadows: How Two Leaks Unmasked the Criminal Network of Yalishanda (Media Land) and BlackBasta The interesting thing about cybercrime is that, sooner or later, the names behind it come out. And very often, the downfall starts from the inside actors turning on each other, internal drama spilling into the open, or someone close enough to cause real damage. Last year, two major leaks surfaced: 🧨 One involved BlackBasta, a ransomware group. 🏢 The other involved Media Land, a legitimate Russian hosting company. On the surface, these leaks looked unrelated. But combined and supported by additional investigation, they led to a “shocking” discovery: Media Land appears to be a front for Yalishanda’s bulletproof hosting (BPH) business, which in turn supported and partnered with ransomware groups such as BlackBasta. And this is exactly why infrastructure matters. We often talk about ransomware as if it exists in a vacuum, “a group,” “a payload,” “an attack.” But ransomware is an ecosystem. It needs servers, domains, hosting providers, admins, brokers, and intermediaries. Someone has to provide the backbone that keeps operations running. BPH is not just “hosting”,  it’s protection, resilience, and operational continuity. Beyond the technical details and money flows, there’s also a human aspect. And I did what I’ve been focused on for years: digging into the human side of the story. Because cybercrime is done by people. 🧩 When you investigate people, every detail matters: where they’re from, the culture they operate in, the education they had, the circles they move in, and how their paths intersect. This is where the story becomes less about infrastructure and more about relationships and how criminal trust is built. In the story of Yalishanda and BlackBasta, two key figures are central: Kirill Zatolokin and Aleksandr Volosovik (both sanctioned last year). What’s fascinating is how many similarities appear in their backgrounds, including intersections involving China and even their places of birth. This is what I suspect may explain how they bonded, found each other, and what made them trust each other enough to build something like this. 🔍 And of course, one of the most important parts of this story is the intersection of cybercrime and legitimate business in the Russian-speaking ecosystem. That overlap makes operations easier for criminals but it also creates opportunities for law enforcement. Sometimes the “legit” layer is exactly what exposes the whole network, as we saw with Media Land and its affiliated entities and individuals. 🧠 True Cybercrime stories are crimes committed by people, against people. Telling these stories matters, not just for entertainment, but for research, awareness, and educating a broader audience. It’s something we should do more of. Read here 👉 analyst1.com/infrastructure-… Stay secured, stay informed with @Analyst1 🦅

🚨 BKA and Europol Add BlackBasta Leader Oleg Nefedov, a Russian Citizen, to Wanted List; Raids Also Conducted in Ukraine 📌 On January 15, 2026, the German Federal Criminal Police Office (BKA ZIT), in cooperation with Europol, officially placed Oleg Nefedov on their wanted list in connection with Black Basta, one of the most prolific ransomware gangs of the past several years. Source: bka.de/DE/Presse/Listenseite… 📌 Nefedov, widely identified through leaked internal chats as the leader of BlackBasta, previously escaped custody in Armenia in 2024 before extradition proceedings could take place, and remains wanted by both U.S. law enforcement and Interpol. bka.de/DE/IhreSicherheit/Fah… eumostwanted.eu/#/nefedov-ol… 💡 Read our previous research here: analyst1.com/inside-blackbas… 📌 In addition, raids were conducted in Ukraine, targeting suspected members of a ransomware group with Ukrainian nationality, accused of so-called hash cracking. These measures were carried out by the Ukrainian Cyber Police and the Office of the Prosecutor General of Ukraine in the Ivano-Frankivsk and Lviv regions. 📌 Another suspect’s residence was also searched in August 2025 as part of joint German-Ukrainian cooperation. During the search near Kharkiv, authorities secured evidence and questioned the suspect regarding the alleged offenses. He is suspected of acting as a so-called “crypter,” ensuring that the malware used was not detected by antivirus programs. 📌 These actions are another reminder of how big and complex the cybercrime ecosystem really is. It’s divided by areas of responsibility and ranks inside as well distributed across different countries, which makes the Russian-speaking cybercrime ecosystem challenging to investigate. 📌 Our recent research highlights key actors behind Yalishanda’s BPH, which served as one of the main backbones of the BlackBasta ransomware business. This is yet another reminder of how multi-layered cybercrime really is and, more importantly, of the people behind it, whose stories we uncover and tell through our research. 💡 If you want to learn more about the actors and see some of the financial trails, you’ll even find personal wallets we identified as being used by Nefedov himself. Read here: analyst1.com/infrastructure-… Huge shoutout to law enforcement and all the defenders out there who contribute to this constant fight against cybercrime. 🙌💪 Stay informed, stay alert with @Analyst1 🦅

🚨 Ransomware Activity: Attack on the Chilean Healthcare Provider & The Grinch of 2025 Goes to Devman 📌 When it comes to holidays, ransomware actors activate. Data leak site activity in December 2025 was one of the highest months of the entire year, with nearly 900 claims recorded. 📌 Don’t they have personal lives and celebrate themselves? Yes, they probably do. But many of these holidays are international. In the case of Russian actors, Christmas in December isn’t even their Christmas. With the main celebrations historically centered around New Year, Christmas itself is observed in early January. 📌 On top of that, we often talk about how these actors taking advantage of understaffed companies, which makes sense, because ransomware actors are opportunistic by nature. But I’d argue there’s something more disturbing underneath, and we’ve started seeing more evidence of it lately. 📌 The healthcare sector is being targeted more frequently, and while this is often explained as a lucrative target due to its low tolerance for downtime, that’s not the full story. Some actors clearly seem to take actual pleasure in it. ‼️ And the Grinch nomination of 2025 goes to Devman. 📌 Devman hit a Chilean healthcare provider just days before Christmas. The stolen data reportedly included extremely sensitive medical information, including HIV test results. When ransom negotiations didn’t move fast enough, Devman escalated. 📌 This actor has been around for a while and is especially known for extensive activity on X. That’s where he comments on recent attacks, threatens and intimidates individuals, including researchers and appears to genuinely enjoy what he does. He did the same with Chilean clinic. 📌 While the precise extent of data exfiltrated (the 250 GB figure) and its contents come from Devman’s own postings rather than independent forensic disclosures, there’s another critical angle of this attack that directly impacts mitigation: reputation and how personal attacks have become. 📌 Mitigation is not just about containment and recovery, it’s about controlling narrative, exposure, and trust. The cost of reputational harm, regulatory scrutiny, lawsuits, and loss of public confidence can easily outweigh the technical impact of the attack itself. 📌 Handling this requires organizations to shift mindset early. Crisis communication, legal strategy, and executive alignment must happen in parallel with incident response, not after. Silence, delays, or underestimating public escalation only give actors like Devman more leverage. ❗ Reputation is part of the ransom. ❗ Trust is the new attack surface. ❗ Your name is on the line, not just your network. Stay secured, stay informed with @Analyst1 🦅

🚨 Russia’s Digital Squid Game and the Players Who Never See the Script: Ukrainian Woman Indicted for Participation in Pro-Russia Hacktivist Groups 📌 On December 9, 2025, Victoria Eduardovna Dubranova, 33, a Ukrainian national, was announced to be indicted for her participation in CARR and NoName057(16), pro-Russia hacktivist groups. This case is interesting in so many aspects. Let’s unpack. 📌 One of the questions that keeps me up at night is the involvement of the Russian government in what we still call “traditional cybercrime.” And more importantly: what do we even call traditional cybercrime these days? To give you my perspective: when the state has its hand in every single aspect of people’s lives, the chances of it staying away from cybercrime are close to zero. 💠 Start with traditional APTs: The state is the command-and-control, with dedicated intelligence officers involved. No outsiders. 💠 Then ransomware: It started as independent groups. It grew so large that it caught the state’s attention. Here is Conti, and the post-Conti groups like BlackBasta. The evidence from leaked chats speaks for itself. 💠 Then came February 2022. When the surge of pro-Russia hacktivist groups appeared after the full-scale invasion of Ukraine, one thing was clear: they did not look like typical hacktivist groups. Like a constructed Frankenstein, they tried to present themselves as regular people driving the operations, but their activity and the language they used clearly came from somewhere higher: the state. What happened is another evolution: ❗ APTs = fully state ❗ Ransomware = independent, later influenced by the state ❗ Hacktivists = launched by the state, then spread to the masses 📌 Why the need for a digital army and how it is built is something I break down in my recent report. Read here: analyst1.com/russian-cybercr… But back to Dubranova’s case. Three things stand out: 1️⃣ Another woman in cybercrime. In a male-dominated ecosystem, every female participant is notable, not as an anomaly, but as a signal worth studying. 2️⃣ Her nationality. I often emphasize this: Russian-speaking cybercrime is held together by language, not nationality. That distinction is critical for understanding the ecosystem and for law enforcement and jurisdictional realities. 3️⃣ The involvement of the state. The indictment references the involvement of a Russian intelligence officer Cyber_1ce_Killer, aka Commander, associated with GRU and FSB. Direct or indirect state influence is exactly the dimension that must be investigated with far more attention. And this case offers yet another confirmation that the line between hacktivism, cybercrime, and state is thinner than ever, in some cases, nonexistent. 📌 In the end, it’s a perfect Squid Game metaphor, ordinary people convinced they’re part of the mission, when really they’re just the expendable contestants in someone else’s script. Stay informed, stay alert with @Analyst1 🦅 Announcement: justice.gov/usao-cdca/pr/jus…

🚨 [New Report] Patriotism-as-a-Service: Investigating the State’s Influence on Russian Cybercrime 📌 What does a Victory Day parade in Red Square have in common with a Telegram bot that gives you 30 points for reporting “Russophobic” content? And what does any of it have to do with modern hacktivism? More than you’d think. 📌 In our new report, "Russian Cybercrime & State Militarization: Marching Together in the Digital Age," we trace how Russia’s century-long obsession with militarization evolved into a digital mobilization machine. 📌 In the attempt to answer whether Russian cybercriminals are marching in step with the state, we’ll lay out the evidence. Think of it as building a conspiracy board: we’ll keep the tone analytical, with a light sprinkle of sarcasm. When the state speaks half in bureaucracy and half in slogans, sometimes the only accurate translation is irony. 📌 Enter the All-Russia People’s Front (ONF), Vladimir Putin’s public movement turned social mobilization engine. Its offshoot, CyberSquad, launched in 2023 to “defend the information space.” When your country tells you to “defend the Motherland,” accompanied with draconian laws designed to instill fear… and then hands you a “Putin Team” hoodie and a Telegram bot… welcome to digital conscription. 📌 Volunteers join via Telegram bot, earn ranks, report “enemy content,” and get rewarded and awarded. It’s gamified patriotism — loyalty by leaderboard. We interacted with the bot too, to show what these tactics look like in practice. 📌 If CyberSquad is the public face, the sanctioned pro-Russia CyberArmy of Russia (CARR) is its darker mirror, a so-called hacktivist group that’s claimed attacks on U.S. and European infrastructure, including a 2024 breach of municipal water systems in Texas. 📌 Their language, symbols, and slogans? Practically indistinguishable from official state propaganda. The “Z” logo, patriotic rhetoric, St. George’s ribbon, and even Putin’s own quotes appear throughout their Telegram posts. 📌 This Patriotism-as-a-Service campaign is chillingly effective. The Kremlin doesn’t need every hacker to be an FSB or GRU officer. It just needs to make patriotism feel like participation. As Russia’s hybrid warfare continues to fuse propaganda, policy, and cyber operations, the tools of influence are reaching deeper into society, normalizing a permanent state of digital mobilization. 📌 Digital warfare isn’t coming, it’s already here. And in Russia’s case, it’s a country-sized army wearing a "Putin Team" hoodie and a St. George’s ribbon, one click away from its next mission. Read here 👉 analyst1.com/russian-cybercr… Stay informed, stay secured with @Analyst1 🦅

Join us for our webinar to learn more about my recent research 🤓👇🏻 🗓️ November 19, 2025 @ 11am EST

🚨 [New Report] The Aeroflot Cyberattack: A Joint Strike by Ukrainian and Belarusian Hacktivists Blending Disruption with Psychological Warfare 📌 Remember the joint cyberattack carried out by two pro-Ukraine hacktivist groups Silent Crow and the Belarusian Cyber Partisans, against Russia’s largest airline, Aeroflot? 📌 In our new piece, we show how this operation went far beyond technical disruption. It was a calculated act of psychological warfare. 📌 As digital battlefields expand and hybrid warfare becomes the norm, cyberattacks are no longer just about taking down systems. They’re about shaping perception, breaking morale, and striking at emotional weak points. 📌 What made this case especially impactful was the cultural proximity of Ukrainian and Belarusian actors to Russian society. They know the language, the sensitivities, the pressure points and they weaponized that familiarity to make the attack personal. 📌 We examine the psychological strategies used by Silent Crow and the Belarusian Cyber Partisans, including language targeting, cultural weaponization through humor and code-speak, and subtle mockery. 📌 This isn’t just cyberwarfare. It’s narrative dominance and disrupting an adversary’s sense of control. What we’re witnessing is the evolution of hacktivism into full-spectrum influence operations, where the targets aren’t just infrastructure, but minds, morale, and public confidence. Read here 👉 analyst1.com/the-aeroflot-cy… Stay secured, stay informed with @Analyst1 🦅