Skip to navigation

Threat reportThreat IntelligenceTL-2026-5279

Rehub: Russian-Language Cybercrime Forum Emerging as Primary Ransomware Marketplace (Post-XSS/RAMP Takedowns)

mediumACTIVE

Flashpoint reports Rehub, a Russian-language cybercrime forum launched in August 2025 by a former XSS moderator, has become a primary ransomware marketplace after the XSS takedown (July 2025) and the RAMP seizure (January 2026). It had over 8,300 active users by July 2026 and is likely sponsored by the DragonForce RaaS, with The Gentlemen, CHAOS, Anubis, LockBit and DevMan also active on it. First disclosed .

Key facts for Rehub forum ransomware market

IdentifiersTL-2026-5279
Also known asRehub ransomware marketplace
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
AttributionReHub Forum Operators (low confidence)
MalwareChaos, Cobalt Strike, DEVMAN, DragonForce, LockBit, SystemBC - S9001, Zlader, anubis, nova, the gentlemen
ToolsCobalt Strike, SoftPerfect Network Scanner
MITRE ATT&CK techniquesT1583 Acquire Infrastructure, T1587.001 Develop Capabilities: Malware, T1588.001 Obtain Capabilities: Malware, T1588.002 Obtain Capabilities: Tool, T1650 Acquire Access, T1657 Financial Theft, T1685 Disable or Modify Tools
MotivationFINANCIAL
Target sectorsmanufacturing, retail, real estate, transport, government administration, finance
Target regionsNorth America, Europe, australia, Global
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Rehub forum ransomware market

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5279 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SoftPerfect Network Scanner Execution (DragonForce Pre-Ransomware Discovery)

Detects execution of SoftPerfect Network Scanner (netscan.exe), a network discovery tool reported in DragonForce ransomware intrusions. DragonForce is the likely sponsor of the Rehub ransomware marketplace (TL-2026-5279), and internal subnet scanning with this tool is a common precursor to encryptor deployment. Matches on OriginalFileName, image name and Product/Company metadata so a renamed binary is still caught.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1046, T1588.002
  • Data sources: sysmon, index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
  • Severity: medium
  • Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
(OriginalFileName="netscan.exe" OR Image="*netscan.exe" OR Image="*netscan64.exe" OR Product="*SoftPerfect*" OR Company="*SoftPerfect*" OR Description="*SoftPerfect*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(Hashes) as hashes by host User Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("netscan.exe", "netscan64.exe") or ProcessVersionInfoOriginalFileName =~ "netscan.exe" or ProcessVersionInfoProductName has "SoftPerfect" or ProcessVersionInfoCompanyName has "SoftPerfect"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: SoftPerfect Network Scanner Execution (DragonForce Pre-Ransomware Discovery)
id: 7b0f3a52-4c1e-4d7a-9a63-2e5b8f41c901
status: experimental
description: Detects execution of SoftPerfect Network Scanner (netscan.exe), a discovery tool reported in DragonForce ransomware intrusions linked to the Rehub ecosystem (TL-2026-5279).
references:
    - https://flashpoint.io/blog/understanding-illicit-ecosystems-inside-rehub-ransomware-marketplace/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.discovery
    - attack.t1046
    - attack.resource-development
    - attack.t1588.002
    - attack.tool.softperfect_netscan
logsource:
    category: process_creation
    product: windows
detection:
    selection_orig:
        OriginalFileName: 'netscan.exe'
    selection_img:
        Image|endswith:
            - '\netscan.exe'
            - '\netscan64.exe'
    selection_prod:
        Product|contains: 'SoftPerfect'
    condition: 1 of selection_*
falsepositives:
    - Authorised network administrators or IT staff using SoftPerfect Network Scanner
level: medium

Known false positives:

  • Network or IT administrators legitimately using SoftPerfect Network Scanner for asset discovery
  • Authorised penetration tests and red-team exercises

Tuning notes: Allow-list approved admin hosts and accounts (for example by host and User) and the signed hash of your sanctioned netscan build. Raise priority when the parent process is a remote shell, cmd.exe or PowerShell, or when the binary runs from a user-writable path such as Temp, Downloads or ProgramData. Correlate with the external-logon detection TL-2026-5279-KQL-001.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • External Remote Desktop Logon Followed by Network Scanner (Brokered Access Pre-Ransomware) · unlock with TL Creds
  • Service-Spawned Named Pipe Echo or Encoded PowerShell (Cobalt Strike Privilege Escalation) · unlock with TL Creds
  • Connections to Community-Observed RAMP and Related Infrastructure · unlock with TL Creds
  • Shadow Copy and Backup Deletion (Ransomware Impact Preparation) · unlock with TL Creds
  • Windows Defender Tampering via PowerShell, sc.exe or Registry (Ransomware Defense Evasion) · unlock with TL Creds
  • DNS Resolution of RAMP Forum and FBI Seizure Domains · unlock with TL Creds
  • BYOVD Vulnerable Driver Load for Security Tool Tampering (DragonForce) · unlock with TL Creds
  • Cobalt Strike Default Named Pipes (DragonForce Post-Exploitation C2) · unlock with TL Creds

Indicators of compromise for Rehub forum ransomware market

As of 2026-11-04, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5279.

Sample indicators (2 of 17)

  • Domain: ramp4u[.]io
  • Domain: ns1[.]fbi[.]seized[.]gov

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for Rehub forum ransomware market

1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Rehub forum ransomware market works

Rehub (also written ReHub or RehubCom) is a Russian-language underground forum founded on 10 August 2025 by a former moderator of the XSS forum. It launched shortly after law enforcement action against XSS: French police, the Paris Prosecutor and Ukrainian authorities, with Europol support, arrested the suspected XSS administrator ('toha') in Kyiv on 22 July 2025, and the XSS domain was seized with a notice on 23 July 2025. XSS had been active since about 2013 (formerly DaMaGeLaB), with more than 50,000 registered users, an escrow and reputation system and a Jabber server.

On 28 January 2026 the FBI, with the US Attorney's Office for the Southern District of Florida and DOJ CCIPS, seized RAMP (Russian Anonymous MarketPlace, ramp4u.io), one of the few forums that openly allowed ransomware promotion. RAMP's nameservers were changed to ns1/ns2.fbi.seized.gov. The RAMP operator known as 'Stallman' acknowledged the seizure on another hacking forum. Researchers observed groups such as Nova and DragonForce shifting activity to Rehub, and Rehub absorbed a significant part of the displaced ransomware community.

According to Flashpoint (21 July 2026), Rehub had over 8,300 active users, about 15,000 posts and nearly 3,000 threads by July 2026. It operates on both clear web and onion domains, introduced a 'zero trust' policy in mid-April 2026, and sells Premium ($100/year) and Patron ($5,000/year) memberships. Forum sections include Sandbox, Technical, Programming, Library, Supermarket, Arbitration and Administration. The Supermarket section lists ransomware affiliate programs, compromised network access, malware tools, stolen financial data, bulk spam infrastructure, forged documents, anonymous hosting and crypto laundering services. DragonForce is likely the primary sponsor or partner, since its banner is permanently displayed on the home page, and the Rehub logo reportedly incorporates part of the DragonForce logo, as RAMP's did. Active RaaS groups include DragonForce, The Gentlemen, CHAOS, Anubis, LockBit and DevMan. DamageLib, launched on 1 August 2025, serves as a companion knowledge-base and archive forum.

DragonForce, per public reporting, runs a franchise-style RaaS (white-label, affiliates keep 80% of ransoms) using LockBit 3.0-based and ContiV3-derived encryptors, Cobalt Strike, SystemBC, SoftPerfect Network Scanner and BYOVD techniques to disable security tooling. The source material lists no CVEs, no network IOCs for Rehub itself (domain and onion addresses are not published in the source) and no nation-state attribution. This is an ecosystem-level threat: defenders should treat Rehub as a source of initial access sales, affiliate recruitment and tool distribution that precedes ransomware intrusions, and use forum monitoring to inform detection priorities.

MITRE ATT&CK techniques by tactic:

Resource Development

T1583 Acquire Infrastructure; T1587.001 Develop Capabilities: Malware; T1588.001 Obtain Capabilities: Malware; T1588.002 Obtain Capabilities: Tool; T1650 Acquire Access

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Remediation for Rehub forum ransomware market

Immediate actions

  • Add Rehub/RehubCom, DamageLib and the named RaaS brands (DragonForce, The Gentlemen, CHAOS, Anubis, LockBit, DevMan) to dark-web monitoring and brand/credential exposure watchlists
  • Review externally exposed remote access (VPN, RDP, Citrix, SSO) and revoke or rotate any credentials seen in stealer logs or access-broker listings
  • Alert on BYOVD driver loads, Cobalt Strike and SystemBC artifacts, and SoftPerfect Network Scanner use inside the environment

Workarounds

  • Block newly observed Rehub clearweb domains at DNS/proxy once validated from threat-intel feeds (no domains are published in the primary source)

Longer-term hardening

  • Maintain immutable, offline backups and rehearse ransomware recovery
  • Deploy EDR with behavioral detection for pre-ransomware activity and tamper protection
  • Enforce phishing-resistant MFA and least-privilege on remote access paths often sold by initial access brokers
  • Subscribe to underground-forum intelligence feeds so migration of ransomware actors between forums is tracked

Timeline of Rehub forum ransomware market

  • Suspected XSS administrator ('locked-ioc-17') arrested in Kyiv by French police and Ukrainian authorities with Europol support
  • XSS forum taken down and domain seized, displacing its ransomware and access-broker community
  • locked-ioc-6 launched as a knowledge-base and archive forum companion to locked-ioc-14
  • locked-ioc-14 founded by a former XSS moderator as a Russian-language cybercrime and ransomware marketplace
  • FBI seizes RAMP (locked-ioc-7) with SDFL and DOJ CCIPS; users, including locked-ioc-16 and locked-ioc-5, reportedly shift to locked-ioc-14
  • locked-ioc-14 implements a 'zero trust' policy (mid-April 2026) for membership and vetting
  • Flashpoint reports locked-ioc-14 has over 8,300 active users, about 15,000 posts and nearly 3,000 threads, with locked-ioc-5 as likely primary sponsor

Sources cited for Rehub forum ransomware market

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats