A database dump from the first three years of Exploit.in, one of the longest-running Russian-language cybercrime forums, shows how a small circle of early members built trading habits that today's ransomware ecosystem still uses, Security Affairs reported Saturday. The analysis, by Ransomnews researcher Dancho Danchev, also found 205 handles from that period that reappear on later ransomware-linked forums.

What Happened

Danchev examined a dump covering February 2005 to May 2008. It contains 9,647 registered members, 13,925 threads and 80,891 posts.

Most accounts were silent. According to the analysis, 5,843 members, or 60.6%, never posted, and about 15% posted only once. Just 82 accounts wrote more than 200 posts. The top 1% of users produced 52.6% of all content, which Danchev reads as roughly 90 truly active members surrounded by a few thousand readers.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The activity data also shows a working routine. Posting ran steadily from morning to evening and peaked around 10 p.m. Moscow time, and weekend activity was 8% lower than on weekdays.

Two password-protected sections held private material, including stolen credit card and bank account data. Public reputation lists tracked which traders others could trust.

Why It Matters

The most useful finding for investigators is the overlap in aliases. Danchev identified 205 distinctive handles from the 2005-2008 dump that also appear in archives of later forums such as XSS, RAMP and BreachForums. Of those, 26 had 20 or more posts on Exploit.in, and 13 had more than 100.

A matching handle does not prove that the same person is behind both accounts, since names can be reused or imitated. But established handles carry reputation in these markets, which gives criminals a reason to keep them for years. Researchers and law enforcement often use such overlaps as a starting point, combining them with writing style, contact details and transaction history to link activity across platforms.

The structure of the early forum also maps onto how ransomware operations are organized now. Danchev argues that the reputation lists evolved into escrow services, and that the tiers controlling access to private sections turned into the vetting that ransomware-as-a-service groups apply to affiliates before sharing their tools. In both eras, a small group of trusted insiders controls access, while a large audience watches.

Context

Russian-language forums such as Exploit.in and XSS have long served as marketplaces for initial network access, stolen data and recruitment of ransomware partners. Their longevity is part of their value: a member with years of trades and positive feedback can sell access or join a ransomware program more easily than a newcomer. Historical dumps like this one are among the few sources that show how those reputations were first built.

What to Watch

The handle overlaps could feed attribution work on long-running actors, particularly the 13 accounts with substantial early posting histories. Watch for whether Danchev or other researchers publish follow-up work tying specific early aliases to known ransomware operations, and whether law enforcement cites historical forum data in future indictments or takedowns.