# Rehub: Russian-Language Ransomware-as-a-Service Marketplace Absorbing RAMP's Displaced Operators

> Rehub (ReHubCom) is a Russian-language cybercrime forum founded August 10, 2025 by a former XSS moderator that has grown to 8,300+ active users and become one of the primary landing zones for ransomware operators displaced by the FBI's January 28, 2026 seizure of the RAMP forum. It now hosts multiple active RaaS programs -- DragonForce (assessed primary sponsor), The Gentlemen, CHAOS, Anubis, LockBit, and DevMan -- alongside initial-access brokerage, carding, and AI-enabled fraud discussion.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2532
- **ID:** TL-2026-2532
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-32433, CVE-2025-33073

## Description

Rehub emerged from the collapse of the two-decade Russian-language cybercrime forum ecosystem. XSS.is, the dominant forum since the DaMaGeLaB era, was seized on July 22-23, 2025 by French and Ukrainian police (Operation Ratatouille, led by JUNALCO with SBU support) after a four-year investigation, resulting in the arrest of a 38-year-old administrator in Kyiv who Europol says earned over EUR 7 million as a trusted escrow middleman. Former XSS moderators launched a successor forum, DamageLib, on August 1, 2025, retaining roughly two-thirds of XSS's ~50,000 membership but with markedly lower engagement, amid member suspicion that the admin handle may be law-enforcement-controlled. A separate former XSS moderator launched Rehub (ReHubCom) on August 10, 2025 as a lower-friction, structured marketplace with tiered paid membership (free entry under a zero-trust policy added mid-April 2026; Premium/Gold at $100/year; Patron/Pink at $5,000/year) and dedicated forum sections for technical discussion, programming, a leaked-data/utility library, a 'Supermarket' for ransomware affiliate programs and stolen financial data, and an arbitration system with a scammer black list.

Rehub's significance sharpened after the FBI, working with the U.S. Attorney's Office for the Southern District of Florida and DOJ CCIPS, seized the RAMP (RAMP4U, ramp4u.io) forum's clearnet and Tor infrastructure on January 28, 2026. RAMP had operated since July 12, 2021 -- founded by Mikhail Matveev ('Orange') from the remnants of the Babuk operation and later run by an administrator using the handle 'Stallman' -- as a dedicated safe haven for ransomware discussion after XSS and Exploit.in banned it post-Colonial Pipeline, hosting Conti, ALPHV/BlackCat, Qilin, RansomHub, AvosLocker, and other affiliate programs plus access brokers selling government and critical-infrastructure network entry. The seizure gave the FBI access to member emails, IPs, and private messages, and rather than consolidating around one successor, displaced operators fragmented across two platform types: T1erOne, a gated forum requiring reputation vetting or a ~$450-500 entry fee that emerged in early February 2026, and Rehub, whose lower barrier to entry absorbed affiliates, initial-access brokers, and general forum regulars. DragonForce joined Rehub the same day RAMP went dark, an opportunistic migration; LockBit and The Gentlemen had maintained a presence on Rehub since September 2025, predating the RAMP disruption.

By July 2026, Flashpoint assessed Rehub at over 8,300 active users, ~15,000 posts, and nearly 3,000 threads, with DragonForce holding a permanent home-page banner as the forum's primary sponsor or partner. The other RaaS operations advertised on the forum are independently well-documented and dangerous: DragonForce (RaaS since late 2023, built on leaked LockBit 3.0/Conti code, 645+ claimed victims across 65 countries by end of August 2026, and a Go-based Microsoft-Teams-relay backdoor named Backdoor.Turn); The Gentlemen (active since July 2025, the most active RaaS operation of Q2 2026 with ~332 published victims in the first five months of the year, exploiting FortiOS and Erlang/OTP SSH CVEs and NTLM relay for initial access/lateral movement, using a large offensive tool suite including NetExec, CertiHound, and MANSPIDER, and suffering its own backend 'Rocket Database' leak in May 2026 that exposed admin and affiliate TOX IDs); CHAOS (assessed with moderate confidence to be operated by former BlackSuit/Royal members, using email-bombing and Quick-Assist vishing for initial access, RMM tools for persistence, and GoodSync disguised as a legitimate binary for exfiltration); Anubis (RaaS since December 2024 offering encryption, data-theft-only, or hybrid extortion splits, notable for an optional /WIPEMODE destructive wiper that zeroes file contents beyond recovery); LockBit (revived as LockBit 5.0 in September 2025 post-Operation Cronos, cross-platform Windows/Linux/ESXi payloads, 335+ claimed victims across 68 countries by August 2026); and DevMan (emerged April 2025 from the DragonForce/Conti lineage, a closed multi-RaaS-affiliate operation targeting APAC/African mid-market and critical-infrastructure organizations, 116+ compromised organizations). Beyond ransomware, the hunt rationale notes Rehub's Technical section hosts AI-jailbreaking and deepfake social-engineering discussion, and its Supermarket section trades network access, carding data, and forged documents -- positioning the forum as general-purpose criminal infrastructure rather than a single-actor threat. For defenders, Rehub itself is not an intrusion vector; its significance is as durable coordination infrastructure that keeps the affiliate pool, tooling, and initial-access supply chain feeding into DragonForce, The Gentlemen, CHAOS, Anubis, LockBit, and DevMan intrusions operational despite law-enforcement pressure on RAMP and XSS.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1574.011 Services Registry Permissions Weakness
- T1134.002 Create Process with Token
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1021 Remote Services
- T1490 Inhibit System Recovery
- T1485 Data Destruction

## Sources

- [Understanding Illicit Ecosystems: Inside Rehub Ransomware Marketplace](https://flashpoint.io/blog/understanding-illicit-ecosystems-inside-rehub-ransomware-marketplace/)
- [FBI Seizes RAMP Cybercrime Forum Used By Ransomware Gangs](https://www.bleepingcomputer.com/news/security/fbi-seizes-ramp-cybercrime-forum-used-by-ransomware-gangs/)
- [Darknet forum RAMP4U seized by FBI](https://www.darkowl.com/blog-content/darknet-forum-ramp4u-seized-by-fbi/)
- [The Rise and Fall of RAMP: Inside the Forum Where Ransomware Was Always Welcome](https://www.cloudsek.com/blog/the-rise-and-fall-of-ramp-inside-the-forum-where-ransomware-was-always-welcome)
- [The Post-RAMP Era: Allegations, Fragmentation, and the Rebuilding of the Ransomware Underground](https://www.rapid7.com/blog/post/tr-post-ramp-allegations-fragmentation-ransomware-underground-rebuild/)
- [XSS Forum After Takedown: DamageLib Emerges](https://www.kelacyber.com/blog/xss-forum-after-takedown-damagelib-emerges/)
- [Thus Spoke...The Gentlemen](https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/)
- [DragonForce Ransomware Attack Analysis - Targets, TTPs and IoCs](https://cybersecuritynews.com/dragonforce-ransomware-attack/)
- [Chaos Ransomware: RaaS Resurgence & Detection](https://www.attackiq.com/2026/07/16/chaos-ransomware/)
- [Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper](https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2532