{
	"id": "6e14d3f2-0405-431b-906e-4d26c6c25dce",
	"created_at": "2026-04-06T01:32:32.078806Z",
	"updated_at": "2026-04-10T13:12:42.390718Z",
	"deleted_at": null,
	"sha1_hash": "3b0ced8680d60b6de7eb375c883e3bc0bc60b190",
	"title": "“This Forum is a Bunch of Communists and They Set Me Up”, LockBit Spills the Tea Regarding Their Recent Ban on Russian-Speaking Forums",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1554584,
	"plain_text": "“This Forum is a Bunch of Communists and They Set Me Up”\r\n,\r\nLockBit Spills the Tea Regarding Their Recent Ban on Russian-Speaking Forums\r\nBy Anastasia Sentsova\r\nPublished: 2024-02-08 · Archived: 2026-04-06 00:34:16 UTC\r\nContributor: Jon DiMaggio.\r\nWhat Happened?\r\nOn January 30, 2024, LockBitSupp, a member of the infamous LockBit ransomware group, faced a ban from two\r\nprominent Russian-speaking forums: XSS and Exploit. These forums hold a significant position in the Russian-speaking underground community, being among the oldest forums in existence. The forums are well-structured,\r\nwith various sections catering to the diverse interests of illicit activity amongst its users. Arbitration is one of the\r\nsections available to members, allowing them to file complaints against each other, with forum admins making\r\ndecisions based on the situation presented.\r\nFigure 1: LockBit banned on Exploit and XSS and\r\nassigned with the status of “Ripper” (Rus: Кидала)\r\nSource: Analyst1\r\nGetting banned from these forums typically involves a serious violation, and LockBit’s ban was prompted by a\r\ncomplaint from another forum member under the alias “michon.” According to michon, they had collaborated\r\nwith LockBit, providing access to a target entity. However, LockBit allegedly extorted the target without sharing\r\nany of the profit, leading to the complaint and subsequent ban.  \r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 1 of 8\n\nFigure 2: Forum member michon stated that LockBit refused to share a profit after its payout.\r\nSource: Analyst1\r\nLockBit responded with their perspective on the situation, asserting that michon initiated contact with them and\r\nprovided access to a breached company without any formal agreement. LockBit successfully extorted the\r\npayment, and later michon requested a percentage of the payout in the amount of 4 million USD, which\r\nLockBitSupp refused to pay. Following the dispute, both parties initially agreed to handle it privately, but michon\r\nopted to make it public.\r\nFigure 3: LockBit provides their side of the story by sharing a message on XSS\r\nSource: Analyst1\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 2 of 8\n\nAfter the complaint was addressed publicly, an administrator requested that LockBitSupp share 10% of the\r\nobtained profit, LockBitSupp declined, leading to their ban. The forum admin stated, “Unfortunately, the\r\ndefendant refused – status assigned. Case closed.”.\r\nIn addition, the admin of XSS once again emphasized the ban on the ransomware topic when explaining the\r\nrationale behind LockBit’s ban. They stated, “It’s disheartening to witness such arbitrage, especially in light of\r\nthe real and not imaginary ban on ransomware discussions. I would like to remind everyone of rule number 9:\r\nRansomware is strictly prohibited” referring to the ban of the ransomware topic established back in May 2021.\r\nFigure 4: Admin’s message on XSS banning LockBitSupp and\r\nassigning them with the status “Ripper”\r\nSource: Analyst1\r\nLockBitSupp was banned from XSS and later from Exploit, with the status “Ripper” (Rus: Кидала) assigned.\r\nBeyond the ban itself, this status is arguably the most detrimental for a forum member. It signifies a lack of trust,\r\nmaking it strongly discouraged for anyone to engage in collaboration with them. To protect their reputation and\r\nprove themselves not guilty, LockBitSupp took this to another DarkWeb forum RAMP to appeal this ban.\r\nNot Guilty Until Proven Otherwise\r\nRAMP is a Russian-speaking DarkWeb forum fully dedicated to ransomware activity. LockBit was one of the first\r\nransomware operations to promote its affiliate program back in 2021 when RAMP was launched after an official\r\nban of the ransomware topic on XSS forum. It was later revealed that the creator of RAMP is the infamous\r\nBorisElcin, also known as Wazawaka, who was later identified as Mikhail Matveev.\r\nIn May 2023, Mikhail Matveev faced sanctions from the U.S. Department of the Treasury’s Office of Foreign\r\nAssets Control (OFAC) due to his suspected involvement in multiple ransomware attacks conducted by Hive,\r\nLockBit, and Babuk ransomware syndicates. Matveev, operating on RAMP initially under the aliases TetyaSluha\r\nand later Orange, eventually relinquished his admin rights.\r\nIt is unclear if Matveev is currently involved in any of RAMP operations. The current admin is an actor operating\r\nunder the moniker Stallman, a very well known and respected member of the Russian-speaking DarkWeb\r\ncommunity.\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 3 of 8\n\nOn Thursday, February 1st, 2024, LockBitSupp leveraged the RAMP forum to tell its side of the story surrounding\r\nthe events that led to the ban on other Russian underground forums. You can see the post in Figure 5 below.\r\nFigure 5: LockBit appeal on RAMP. Translated by Analyst1\r\nSource: Analyst1\r\nLockBitSupp made a post on the RAMP forum, asking the forum administrator, Stallman, to re-evaluate the\r\nincident and make an independent determination regarding whether LockBit cheated michon out of the money it\r\nwas owed for its services. In the post, LockBitSupp claims that the administrator who ruled against it and enforced\r\nthe ban had ulterior motives influencing their decision. According to LockBitSupp, the ruling XSS admin is the\r\nfriend of a former XSS moderator and the plaintiff, who also had a previous conflict with LockBitSupp.\r\nLockBitSupp believes that this relationship affected the admin’s ability to adjudicate the complaint fairly.\r\nWhile Analyst1 cannot confirm the relationship between the former XSS moderator and the administrator, it\r\nappears plausible based on the infrequent enforcement of the rule against ransomware discussions on XSS. The\r\nforum is full of conversations about ransomware, yet enforcement is rare and selective. Furthermore, LockBitSupp\r\nhas frequently engaged in ransomware discussions since joining the forum in March 2021 without facing\r\nconsequences from XSS moderators until the complaint was filed.\r\nTypically, the XSS admins require complainants to provide evidence of a valid agreement for unpaid services in\r\norder to find someone guilty in such situations. However, based on the logs submitted by LockBitSupp, no such\r\nagreement was made. In other words, the logs showed that the parties discussed a payment but never agreed upon\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 4 of 8\n\nthe terms or amount, yet the complainant still provided access. The XSS admin confirmed that no prearranged\r\npayment agreement existed, yet still ruled in favor of the complainant.\r\nWhile it’s uncommon for us to agree with a threat actor, if we disregard the illegal services and criminal acts that\r\nthe parties are disputing over and focus on the ruling based on the presented evidence in the arbitration, it seems\r\nunfair to hold a party accountable for a monetary amount that was not agreed upon in advance by both parties.\r\nAnalyst1 had a conversation with LockBitSupp, discussing the events that occurred and the ruling made by the\r\nXSS administrators. We questioned LockBitSupp about why they didn’t agree to payment terms beforehand to\r\navoid this situation completely.\r\nLockBitSupp explained that the complainant lacked experience, credibility, and reputation, which made it difficult\r\nto agree to upfront payment without knowing what they would receive in return. LockBitSupp also mentioned that\r\nthey often encounter criminals who make empty promises in an attempt to scam the group, and they only make\r\npayment after a successful criminal operation where the involved criminals have fulfilled their part of the\r\nagreement. Analyst1 can confirm this statement, as it aligns with the terms outlined in the group’s affiliate rules\r\nlisted on their data leak site.\r\nWe asked LockBitSupp if this was true, why did it not pay the complainant after the criminal engagement was\r\ncompleted. LockBitSupp stated the complainant became confrontational and impatient and publicly leaked private\r\ninformation about the operation on the forum, which is an offense within the criminal community.\r\nWe also asked LockBitSupp why it was banned by the Exploit forum if the complaint was filed on the XSS forum.\r\nLockBitSupp explained that “This is the rule in the Russian-speaking community and across the forums. If you\r\nare getting banned from one forum, you are automatically excluded from others.” This also explains why\r\nLockBitSupp was upset about the ruling. Getting banned across multiple Russian-speaking forums limits the\r\ngroup’s exposure to other criminals and resources. LockBit also believes that the moderator’s decision, which\r\nrequired it to pay 10% of the criminal revenue generated from the operation in which the complainant provided\r\ninitial access, was biased and unfair. LockBit says it never agreed to such a large sum and refuses to be\r\nblackmailed into making such a payment. Again, we don’t often agree with LockBitSupp, but if the logs provided\r\nare authentic and inclusive, the logs provided support this claim.\r\nAs you may recall, LockBitSupp stood by their decision and refused to make payment, resulting in their expulsion\r\nfrom both the Exploit and XSS forums. However, when LockBitSupp appealed to the RAMP forum administrator,\r\nit hoped for a more favorable outcome – which is exactly what it received. On Sunday, February 4th, 2024,\r\nStallman, the RAMP administrator, determined that LockBitSupp did not violate the terms of the agreement. This\r\ndecision was based on the conversation logs submitted as evidence, which revealed that no prior agreement or\r\npromise of payment had been made.\r\nThe administrator cited statements from the conversation logs as justification for their decision:\r\nLockBitSupp: I don’t have to pay you just for access. I only going to pay you if the victim pays a ransom. What is\r\nnot fair? Where do you see injustice?\r\nmichon: At the moment I want 4 million USD for access.\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 5 of 8\n\nLockBitSupp: Well, I’m not ready to pay you that much for access and no one would ever buy any access for that\r\nkind of money.\r\nHowever, despite the positive ruling made by the RAMP administrator, XSS and Exploit forums have not lifted\r\nthe ban. This means that LockBitSupp may have won the appeal but will not benefit from it. Such a discrepancy in\r\nverdicts between forums is surprising, considering how interconnected the Russian-speaking underground is.\r\nMaking Sense Out of DarkWeb Rambling\r\nDarkWeb forums serve as valuable sources of intelligence, but unlocking their insights requires a thorough\r\nunderstanding of an underground ecosystem. It involves delving into the historical events that have shaped the\r\nunderground over the years as well as examining the profiles of actors, considering their cultural backgrounds that\r\noften influence their behavior.\r\nDrawing parallels between the dynamics of DarkWeb forums and the broader Russian-speaking society, we\r\nuncover striking similarities. Both environments are collectivist in nature, placing a strong emphasis on\r\ncommunity importance, adherence to established guidelines, and the exchange of shared experiences. This fosters\r\na cohesive environment where individuals feel a sense of belonging and camaraderie.  \r\nWhile the story presented to both the underground world and the wider public may appear straightforward, several\r\ndetails about the LockBit ban raise questions. For instance, the lack of forum reputation of the individual behind\r\nthe complaint, who registered their account as recently as January 12, 2024. In an underground where hierarchy\r\nplays a central role in forming relationships, this seems contradictory. LockBitSupp themselves point to this by\r\nsaying, “This is a random person with no established reputation”.\r\nThe hierarchical structure within DarkWeb forums mirrors the organizational structure seen in various aspects of\r\nRussian society, reflecting a preference for a clear and defined chain of command. Moreover, the unwritten code\r\nof conduct, respect for authority, a strong sense of camaraderie are foundational principles that shape\r\nunderground. With the forum’s reputation and assigned ranks, underground members navigate their way through\r\nthe hierarchy, striving to climb the ladder. Until they reach the upper echelons, they treat those already at the top\r\nwith respect.\r\nThe incident involving LockBit’s ban sheds light on another important aspect of the Russian-speaking\r\nunderground: the significance of interpersonal relationships. Trust, collaboration, and deal-making often hinge on\r\nthese relationships, which are established based on mutual interests and common goals. LockBit’s mention of a\r\nclose relationship between the admin who made the decision and former moderator of XSS, who is a friend of the\r\nplaintiff, underscores the interconnected and relationship-based nature of this world.\r\nThe publicity of the event, with a public complaint lodged against a notorious actor from one of the most active\r\nransomware groups, is a rare occurrence in the underground. Violating hacker ethics by sharing internal disputes\r\npublicly is frowned upon, as highlighted by LockBit’s statement: “He shared an internal dispute that shouldn’t\r\nhave been become public, violating hacker’s ethics”. Indeed, in the world of the underground that relies on\r\nprinciples of secrecy, sensitive discussions are typically kept behind closed doors also to avoid attracting\r\nunwanted attention from law enforcement.\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 6 of 8\n\nThis publicity, however, could be seen as an attempt of rivalry from LockBit’s competitors. The public execution,\r\nban, and assigning of “Ripper” status could be interpreted as attempts to discredit LockBit and undermine its\r\nbusiness. Much like in the offline world, reputation is paramount in the DarkWeb, and individuals seek to build\r\nand maintain positive relationships with trusted peers.\r\nThe LockBit ban might also be seen as a pushback from the community itself. It’s possible that some members\r\nperceive LockBit as separating themselves by prioritizing their own interests over those of the community, and\r\nshowing their success too openly. The LockBit statement “They are jealous of me because how rich and\r\nsuccessful I am”, “There is a communism on this forum and their goal is to dispossess the rich” may sound\r\namusing, but they likely hold some truth and offer insight into what happened to LockBit.\r\n“When you start all this talk about the Cartel, you have to understand that you are not alone here. You must\r\nconsider other people’s opinions”, said Bratva, another prominent member of the Russian-speaking DarkWeb\r\ncommunity. Indeed, in a community where collective interests often supersede individual ones, separating and\r\nplacing oneself on a pedestal could be a fatal mistake.\r\nFigure 6: Bratva comments on LockBit’s appeal on RAMP by referring to his resistance to obey the\r\ncommunity rules\r\nSource: Analyst1\r\nThe Russian-speaking underground presents a complex and intricate landscape shaped by multiple factors,\r\nincluding cultural norms, interpersonal relationships, and even the political landscape. Understanding these\r\nnuances is crucial for cybersecurity experts and law enforcement agencies in addressing cybercrime. Analyst1\r\ncontinues to navigate the evolving ecosystem of ransomware for combating emerging threats and building a safer\r\ndigital space.\r\nAbout Analyst1\r\nThreat intelligence teams often struggle to bridge the gap from insight to action. Analyst1 is the Orchestrated\r\nThreat Intelligence Platform designed to resolve this issue. It automatically organizes threat data, links it to your\r\nassets and vulnerabilities, and customizes views for different roles. Analyst1’s orchestration layer streamlines\r\nworkflows and automates reliable actions by integrating with SIEM, ticketing, and vulnerability management\r\nsystems. From Fortune 500 financial institutions to national security agencies, enterprises trust Analyst1 to unify\r\ntheir defenses, significantly reducing their response time from days to minutes.\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 7 of 8\n\nSource: https://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-rus\r\nsian-speaking-forums/\r\nhttps://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/\r\nPage 8 of 8",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://analyst1.com/this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums/"
	],
	"report_names": [
		"this-forum-is-a-bunch-of-communists-and-they-set-me-up-lockbit-spills-the-tea-regarding-their-recent-ban-on-russian-speaking-forums"
	],
	"threat_actors": [],
	"ts_created_at": 1775439152,
	"ts_updated_at": 1775826762,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3b0ced8680d60b6de7eb375c883e3bc0bc60b190.pdf",
		"text": "https://archive.orkl.eu/3b0ced8680d60b6de7eb375c883e3bc0bc60b190.txt",
		"img": "https://archive.orkl.eu/3b0ced8680d60b6de7eb375c883e3bc0bc60b190.jpg"
	}
}