On July 22, 2025, the European police agency Europol<\/strong> said<\/a> a long-running investigation led by the French Police resulted in the arrest of a 38-year-old administrator of XSS,<\/b>\u00a0a Russian-language cybercrime forum with more than 50,000 members. The action has triggered an ongoing frenzy of speculation and panic among XSS denizens about the identity of the unnamed suspect, but the consensus is that he is a pivotal figure in the crime forum scene who goes by the hacker handle \u201cToha<\/strong>.\u201d Here\u2019s a deep dive on what\u2019s knowable about Toha, and a short stab at who got nabbed.<\/p>\n An unnamed 38-year-old man was arrested in Kiev last month on suspicion of administering the cybercrime forum XSS. Image: ssu.gov.ua.<\/p>\n<\/div>\n Europol did not name the accused, but published partially obscured photos of him from the raid on his residence in Kiev. The police agency said the suspect acted as a trusted third party \u2014 arbitrating disputes between criminals \u2014 and guaranteeing the security of transactions on XSS. A statement<\/a> from Ukraine\u2019s SBU<\/strong> security service said XSS counted among its members many cybercriminals from various ransomware groups, including REvil<\/strong>, LockBit<\/strong>, Conti<\/strong>, and Qiliin<\/strong>.<\/p>\n Since the Europol announcement, the XSS forum resurfaced at a new address on the deep web (reachable only via the anonymity network Tor<\/a>). But from reviewing the recent posts, there appears to be little consensus among longtime members about the identity of the now-detained XSS administrator.<\/p>\n The most frequent comment regarding the arrest was a message of solidarity and support for Toha, the handle chosen by the longtime administrator of XSS and several other major Russian forums. Toha\u2019s accounts on other forums have been silent since the raid.<\/p>\n Europol said the suspect has enjoyed a nearly 20-year career in cybercrime, which roughly lines up with Toha\u2019s history. In 2005, Toha was a founding member of the Russian-speaking forum Hack-All. <\/strong>That is, until it got massively hacked a few months after its debut. In 2006, Toha rebranded the forum to exploit[.]in<\/strong><\/a>, which would go on to draw tens of thousands of members, including an eventual Who\u2019s-Who of wanted cybercriminals.<\/p>\n Toha announced in 2018 that he was selling the Exploit forum, prompting rampant speculation on the forums that the buyer was secretly a Russian or Ukrainian government entity or front person. However, those suspicions were unsupported by evidence, and Toha vehemently denied the forum had been given over to authorities.<\/p>\n One of the oldest Russian-language cybercrime forums was DaMaGeLaB<\/strong>, which operated from 2004 to 2017, when its administrator \u201cAr3s\u201d was arrested. In 2018, a partial backup of the DaMaGeLaB forum was reincarnated as xss[.]is<\/a>, with Toha as its stated administrator.<\/p>\n Clues about Toha\u2019s early presence on the Internet \u2014 from ~2004 to 2010 \u2014 are available in the archives of Intel 471<\/strong>, a cyber intelligence firm that tracks forum activity. Intel 471 shows Toha used the same email address across multiple forum accounts, including at Exploit, Antichat<\/strong>, Carder[.]su<\/strong> and inattack[.]ru.<\/strong><\/p>\n DomainTools.com<\/strong> finds Toha\u2019s email address \u2014 toschka2003@yandex.ru<\/strong> \u2014 was used to register at least a dozen domain names \u2014 most of them from the mid- to late 2000s. Apart from exploit[.]in and a domain called ixyq[.]com<\/strong>, the other domains registered to that email address end in .ua, the top-level domain for Ukraine (e.g. deleted.org[.]ua, lj.com[.]ua, and blogspot.org[.]ua).<\/p>\n A 2008 snapshot of a domain registered to toschka2003@yandex.ru and to Anton Medvedovsky in Kiev. Note the message at the bottom left, \u201cProtected by Exploit,in.\u201d Image: archive.org.<\/p>\n<\/div>\n Nearly all of the domains registered to toschka2003@yandex.ru contain the name Anton Medvedovskiy<\/strong> in the registration records, except for the aforementioned ixyq[.]com, which is registered to the name Yuriy Avdeev<\/strong> in Moscow.<\/p>\n This Avdeev surname came up in a lengthy conversation with Lockbitsupp<\/a>, the leader of the rapacious and destructive ransomware affiliate group Lockbit<\/strong>. The conversation took place in February 2024, when Lockbitsupp asked for help identifying Toha\u2019s real-life identity.<\/p>\n In early 2024, the leader of the Lockbit ransomware group \u2014 Lockbitsupp \u2014 asked for help investigating the identity of the XSS administrator Toha, which he claimed was a Russian man named Anton Avdeev.<\/p>\n<\/div>\n Lockbitsupp didn\u2019t share why he wanted Toha\u2019s details, but he maintained that Toha\u2019s real name was Anton Avdeev<\/strong>. I declined to help Lockbitsupp in whatever revenge he was planning on Toha, but his question made me curious to look deeper.<\/span><\/p>\n It appears Lockbitsupp\u2019s query was based on a now-deleted Twitter post from 2022, when a user by the name \u201c3xp0rt<\/a>\u201d asserted that Toha was a Russian man named Anton Viktorovich Avdeev<\/strong>, born October 27, 1983.<\/p>\n Searching the web for Toha\u2019s email address toschka2003@yandex.ru reveals a 2010 sales thread<\/a> on the forum bmwclub.ru<\/strong> where a user named Honeypo was selling a 2007 BMW X5. The ad listed the contact person as Anton Avdeev and gave the contact phone number 9588693.<\/strong><\/p>\n A search on the phone number 9588693 in the breach tracking service Constella Intelligence<\/strong> finds plenty of official Russian government records with this number, date of birth and the name Anton Viktorovich Avdeev. For example, hacked Russian government records show this person has a Russian tax ID and SIN (Social Security number), and that they were flagged for traffic violations on several occasions by Moscow police; in 2004, 2006, 2009, and 2014.<\/p>\n Astute readers may have noticed by now that the ages of Mr. Avdeev (41) and the XSS admin arrested this month (38) are a bit off. This would seem to suggest that the person arrested is someone other than Mr. Avdeev, who did not respond to requests for comment.<\/p>\n For further insight on this question, KrebsOnSecurity sought comments from Sergeii Vovnenko<\/strong>, a former cybercriminal from Ukraine who now works at the security startup paranoidlab.com<\/strong>. I reached out to Vovnenko because for several years beginning around 2010 he was the owner and operator of thesecure[.]biz<\/strong>, an encrypted \u201cJabber\u201d instant messaging server that Europol said was operated by the suspect arrested in Kiev. Thesecure[.]biz grew quite popular among many of the top Russian-speaking cybercriminals because it scrupulously kept few records of its users\u2019 activity, and its administrator was always a trusted member of the community.<\/p>\n The reason I know this historic tidbit is that in 2013, Vovnenko \u2014 using the hacker nicknames \u201cFly<\/strong>,\u201d and \u201cFlycracker<\/strong>\u201d \u2014 hatched a plan<\/a> to have a gram of heroin purchased off of the Silk Road darknet market and shipped to our home in Northern Virginia. The scheme was to spoof a call from one of our neighbors to the local police, saying this guy Krebs down the street was a druggie who was having narcotics delivered to his home.<\/p>\n I happened to be lurking on Flycracker\u2019s private cybercrime forum when his heroin-framing plan was carried out, and called the police myself before the smack eventually arrived in the U.S. Mail. Vovnenko was later arrested<\/a> for unrelated cybercrime activities, extradited to the United States, convicted, and deported after a 16-month stay in the U.S. prison system [on several occasions, he has expressed heartfelt apologies for the incident, and we have since buried the hatchet].<\/p>\n Vovnenko said he purchased a device for cloning credit cards from Toha in 2009, and that Toha shipped the item from Russia. Vovnenko explained that he (Flycracker) was the owner and operator of thesecure[.]biz from 2010 until his arrest in 2014.<\/p>\n Vovnenko believes thesecure[.]biz was stolen while he was in jail, either by Toha and\/or an XSS administrator who went by the nicknames N0klos<\/strong> and Sonic<\/strong>.<\/p>\n \u201cWhen I was in jail, [the] admin of xss.is stole that domain, or probably N0klos bought XSS from Toha or vice versa,\u201d Vovnenko said of the Jabber domain. \u201cNobody from [the forums] spoke with me after my jailtime, so I can only guess what really happened.\u201d<\/p>\n N0klos was the owner and administrator of an early Russian-language cybercrime forum known as Darklife[.]ws<\/strong>. However, N0kl0s also appears to be a lifelong Russian resident, and in any case seems to have vanished from Russian cybercrime forums several years ago.<\/p>\n Asked whether he believes Toha was the XSS administrator who was arrested this month in Ukraine, Vovnenko maintained that Toha is Russian, and that \u201cthe French cops took the wrong guy.\u201d<\/p>\n So who did the Ukrainian police arrest in response to the investigation by the French authorities? It seems plausible that the BMW ad invoking Toha\u2019s email address and the name and phone number of a Russian citizen was simply misdirection on Toha\u2019s part \u2014 intended to confuse and throw off investigators. Perhaps this even explains the Avdeev surname surfacing in the registration records from one of Toha\u2019s domains.<\/p>\n But sometimes the simplest answer is the correct one. \u201cToha\u201d is a common Slavic nickname for someone with the first name \u201cAnton,\u201d and that matches the name in the registration records for more than a dozen domains tied to Toha\u2019s toschka2003@yandex.ru email address: Anton Medvedovskiy.<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/xss-sbu.png?resize=749%2C499&ssl=1\")
<\/p>\nCROSS-SITE GRIFTING<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/exploit-deleted-ua.png?resize=749%2C702&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/lcokbitsupp-convo.png?resize=749%2C938&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/bmw-toha.png?resize=878%2C888&ssl=1\")
<\/p>\nA FLY ON THE WALL<\/h2>\n
WHO IS TOHA?<\/h2>\n