Dancho Danchev checks a copy of The Gentlemen’s leaked chats against six months of Ransomtracker data: 654 leak-site listings since 5 May 2026, more than any rival, 53 confirmed attacks, and no consequences for the crew.
Dancho Danchev
Dancho Danchev
Dancho Danchev is a Bulgarian threat intelligence researcher who has spent more than two decades tracking cybercrime, malware campaigns, and the infrastructure behind the criminal underground. His research covers botnets, including Koobface, exploit kits, blackhat SEO, scareware, and large-scale domain abuse, with a focus on OSINT work that maps campaigns back to the operators running them. He has published through ZDNet Zero Day, Webroot, GroupSense, and WhoisXML API, and has run his own cybercrime research blog since the early 2000s.
RAMP’s administrator ran its escrow, bought US network access daily and offered LockBit the XSS admin’s identity for 10 BTC. Dancho Danchev reads the record.
Inside the Exploit.in database, 2005 to 2008: 9,647 members of the Russian hacker forum, 60% who never posted, and 205 handles still on the boards today.
sourcec0de, an active ransomware operator, answers the opening round of Dancho Danchev’s questions over Tox: on harm, an FSB tip, and why he says the law, not the crime, is unjust. First of a longer interview.
Bashe, also known as APT73, tells Dancho Danchev that interviews raise the price of silence. Then the public record shows how much of that reputation is manufactured.
The group behind RTM Locker speaks to Dancho Danchev about ransomware-as-a-service, why companies really pay, and where the market goes next.
A 152,973-message archive of the Verified forum shows how Russian-speaking cybercrime governed itself between 2005 and 2010, using rules, penalty points and bans.
Quake3, a moderator on the XSS.is cybercrime forum, is the persona DEF CON 33 research placed at REvil’s source-code development, and the man the German BKA named in April 2026. We trace the forum record that ties the handles together.
5socks.net sold access to hacked residential IPs from 2004 until the FBI seized it in May 2025. Dancho Danchev traces the service back to its Russian origins.