Ransomware ads now also banned on Exploit cybercrime forum

The team behind Exploit, a major cybercrime forum used by ransomware gangs to hire affiliates and advertise their Ransomware-as-a-Service (RaaS) services, has announced that ransomware ads are now banned and will be removed.

The move follows the announcement made by the XSS Russian-speaking hacking forum yesterday about ransomware topics being permanently banned.

Exploit's admin says that the decision was taken because ransomware groups locking targets indiscriminately are attracting "a lot of attention."

As he added, besides the ban, all forum topics related to ransomware operations will also be deleted and all affiliate programs will be removed.

The full statement, provided and translated by Advanced Intel's Yelisey Boguslavskiy and Vitali Kremez, is available below.

Good day, We are glad to see pentesters, malware specialists, coders, but we are not happy with lockers - they attract a lot of attention. This type of activity is not good to us in view of the fact that networks are locked indiscriminately we do not consider it appropriate for RaaS partner programs to be present on our forum. It was decided to remove all affiliate programs and prohibit them as a type of activity on our forum.  All topics related to lockers will be deleted.

Exploit and XSS are responding to the increased pressure felt by RaaS gangs who have previously used the two forums, including REvil, LockBit, DarkSide, Netwalker, Nefilim, from both law enforcement agencies and security researchers.

This is a direct result of DarkSide ransomware's attack on Colonial Pipeline which disrupted the US fuel pipeline's operation.

The attack also prompted the White House to address it in this week's national security briefings and issuing a regional emergency declaration affecting 17 states and the District of Columbia.

Ransomware gangs have already expressed their disapproval after XSS posted their decision to ban them from the forums, with the REvil ransomware gang announcing that the operation will move to Exploit.

REvil added that the gang will move onto a private platform within a week, a move that will have to be a lot faster since Exploit also banned ransomware topics to evade unwanted scrutiny.

With more cybercrime and hacking communities pushing ransomware operations off their platforms, it remains to be seen how and if RaaS gangs will keep promoting their activities and recruiting new affiliates.