Blogs

Blog

Understanding Illicit Ecosystems: Inside Rehub’s Rise as a Primary Ransomware Marketplace

As part of our ongoing series, Flashpoint intelligence tracks Rehub, breaking down its migration, infrastructure, and the various RaaS groups sponsoring and partnering with it.

What is Rehub?

Rehub, also known as ReHub or RehubCom, is a Russian-language cybercrime forum founded in August 2025 by a former XSS moderator following its shutdown in the summer of 2025. Rehub dedicates itself to the commercial and marketplace use of ransomware, while its counterpart, DamageLib, serves as a knowledge base archive and exchange.

Operating both on Clear Web domains and an onion domain, the forum positions itself as free from state and law enforcement interference, framing existing XSS iterations as compromised. After law enforcement seized the RAMP (RAMP4U) forum in January 2026, Rehub absorbed a significant portion of the displaced cybercriminal community and became one of the primary destinations for ransomware operators.

Who Are Known Members of Rehub?

There are many notable threat actors among Rehub moderators and users, including ransomware operators, vendors, and other prominent threat actors active across several illicit communities. Several current or ex-Rehub moderators were also maintainers of other illicit forums such as XSS, DamageLib, and RAMP.

Notably, Ransomware-as-a-Service (RaaS) groups such as DragonForce have maintained an active presence on the platform to market their affiliate programs. Flashpoint assesses that DragonForce is likely the forum’s primary sponsor or partner, as their banner is permanently displayed on the forum’s home page, with both logos merged—similar to its previous placement on RAMP. 

Other active RaaS include:

• The Gentlemen
• CHAOS ransomware
• Anubis
• LockBit
• DevMan

What Does Rehub Infrastructure Look Like?

As of July 2026, Flashpoint intelligence observes over 8,300 active users, 15,000 posts, and nearly 3,000 threads. Despite being free to join, Rehub practices a zero trust policy, which was established in mid-April 2026. Under this system, the forum restricts newly registered users from accessing any section other than its Sandbox. Users can also purchase paid upgrades:

• Premium status (gold rank): Costing US $100 per year, this rank grants distinctive color, custom title, nickname changes, unlimited post editing/deletion, extended signature, unlocks all hidden text regardless of post count, likes, join date, ability to bump commercial threads, and inherits all lower-tier perks. 
• Patron status (pink/magenta rank): Costing US $5,000 per year, this rank grants custom title editing, a personal profile link, custom styling for posts, profile, and postbit, and inherits all “Premium” perks.

What are the Various Rehub Forum Sections?

Rehub sections, similar to other forums, are grouped by major activities, separating the knowledge base from commerce and from general discussions.

Sandbox

Serves as an entry-level general discussion area and a place for community questions. Main activity consists of queries about operational security, introductory networking, and entry-level fraud or malware logistics.

Technical

Covers threads ranging from traditional network infrastructure vulnerabilities to emerging technologies such as AI jailbreaking and deepfake social engineering. Highly active, most communications focus on network vulnerabilities and carding.

Programming (Development)

This is a dedicated space for discussions on software engineering, system administration, and web optimization within the forum. Primary activities include sharing programming language tutorials, comparing backend technologies, and developing specialized automation tools.

Library

Serves as a repository of resources for the forum, hosting the most threads and community engagement. Users share operational materials, leaked databases, and utility software. Additionally, this section aggregates cybersecurity and tech industry news and articles.

Supermarket

This is a commercial section featuring ransomware affiliate programs, compromised network access, malware tools, stolen financial data, bulk spam infrastructure, forged documents, anonymous hosting, and crypto laundering services.

Arbitration

Serves as the forum’s internal justice system, where members resolve financial disputes and flag scammers. The “Black List” subsection functions as a public record of bad actors and scam sites.

Administration

This is where forum staff post announcements, policy updates, and operational notices, including rules, official domains, forum news, moderator applications, and 2FA requirements. Members use it to ask questions, request escrow services, propose features, and raise concerns about the forum’s public image.

Monitor Illicit Marketplaces Using Flashpoint

Flashpoint will continue to monitor Rehub’s marketplace activity and infrastructure updates. Rehub’s rapid evolution from a post-XSS refuge to a heavily sponsored ransomware marketplaces demonstrates the resilience of the cybercrime ecosystem. 

Positioning itself as the primary ransomware marketplace, Rehub has built a high-barrier, high-reward environment for sophisticated threat actors. Request a demo to learn how Flashpoint delivers visibility into illicit communities—empowering security teams to track threat actors, identify exposed assets, and mitigate ransomware risks.

See Flashpoint in Action

Blogs

Blog

Inside Qilin Ransomware: Custom Rust Loader and Kernel-Level EDR Killer

In this post we analyze Qilin ransomware’s new custom Rust loader, break down the inner workings of its sophisticated kernel-level EDR killer, and explore how organizations can defend against these aggressive defense evasion tactics. Flashpoint customers can access the full intelligence report—complete with deeper technical analysis and all associated IOCs—directly within Flashpoint Ignite.

Qilin ransomware is a highly active and sophisticated ransomware operation that has rapidly modernized its evasion techniques. Historically focused on file encryption, the ransomware-as-a-service (RaaS) group has expanded its operations to include aggressive, kernel-level defense evasion. By deploying a specialized toolkit, Qilin now focuses heavily on blinding and permanently disabling endpoint security products before its main ransomware payload is executed on a victim’s network.

Flashpoint has observed Qilin quietly deploying a previously unreported custom packer, which has been actively observed in wild samples since May 2024, with continuous use detected as recently as last month.

Here’s how Qilin works:

How Qilin Ransomware Uses a Custom Rust Loader for Reflective PE Loading

Flashpoint analysts observed a custom Rust-written loader that performs reflective Portable Executable (PE) loading of the ransomware payload. After deobfuscation, the code execution jumps to the newly unpacked executable within the same process, avoiding noisier process injection techniques. The following is an overview of the decompiled unpacking routine:

The unpacking routine then reads each DWORD from the embedded bytes, allocates it on the heap, and performs multiple mathematical operations to deobfuscate. Flashpoint notes that the calculations and values used were unique to each sample, but the underlying methodology remained the same.

Manually performing the calculations in the sample confirms the presence of the embedded binary, with the first deobfuscated DWORD yielding an ‘MZ’ header in little-endian format.

To better understand Qilin, Flashpoint analysts created an automated unpacker and configuration extraction script that uses CPU emulation to address the issue of unique calculations per sample. This script uses pattern matching to locate the unpacking routine within the binary. It then reads the disassembly, identifying specific points in the code at which emulation should start and stop.

Reading the disassembly directly avoids issues arising from hardcoded offsets, such as when threat actors add or remove code, or when the compiler introduces changes. Additionally, it provides a smaller set of instructions for emulation, avoiding WinAPI calls and other invalid memory errors that often occur when emulating a full binary.

After additional setup, including mapping the sample into the emulator’s memory and creating a fake heap, the unpacking routine runs successfully.

The script then performs configuration extraction from the deobfuscated bytes produced by the CPU emulation, achieving a 100% success rate.

How Qilin’s New EDR Killer Blinds Security Products

An additional update with Qilin is its new endpoint detection and response (EDR) killer, which Flashpoint found to be sold on illicit marketplaces for US $2,000. This is packed via the Shanya packer—which was sold on XSS for US $100 to US $150 back in 2024. The packer is highly sophisticated, and uses several techniques that make it difficult to analyze, such as junk code, application programming interface (API) hashing, IAT hooking, pattern scanning, and VEH code execution flow.

Once unpacked, the EDR killer starts by using dynamic API hashing and PE walking to resolve a number of useful NTAPI functions it will use throughout the process, and stores them in a structure located within the GdiHandleBuffer within the Process Environment Block (PEB).

The structure stored in the PEB itself looks as follows:

The API hashing algorithm is simple: it performs a bitwise OR of each character of the API name with hexadecimal value 0x20 to convert any and all uppercase characters to lowercase, then performing additional simple calculations.

The EDR killer compares the returned locale to a known locale blacklist to avoid attacking any Commonwealth of Independent States (CIS) countries such as Russia and Belarus.

The malware then attempts to give itself the following privileges by dynamically resolving and calling RtlAdjustPrivilege():

• SE_PROF_SINGLE_PROCESS_PRIVILEGE
  • Required to gather profile information for a single process.
  • Used later to create a map of the victim machine’s physical memory space.
• SE_DEBUG_PRIVILEGE
  • Required to debug and adjust the memory of a process owned by another account.
• SE_LOAD_DRIVER_PRIVILEGE
  • Required to load or unload a device driver.

Abusing Vulnerabilities to Map Physical Memory

The EDR killer then writes a vulnerable driver to disk and loads this driver via Service Manager. This driver is the ThrottleStop driver from TechPowerUp LLC’s free and legitimate application of the same name, used to bypass CPU throttling. However, the driver suffers from a vulnerability, allowing the malware to map physical memory to kernel-mode virtual memory to perform direct kernel read and write operations.

Qilin weaponizes this vulnerability by feeding its EDR killer physical memory addresses, as the driver relies on the API to map physical memory to a kernel-mode virtual address. To achieve this, the EDR killer builds a physical memory map using a Windows memory management service that preloads frequently used applications into RAM.

1. First it gathers baseline information about all physical memory blocks. Because memory pages (typically 4KB) are allocated to physical blocks, hundreds of virtual pages can point to a single physical range.
2. It then calls the service to obtain detailed Page Frame Number (PFN) details. The malware stores this complete mapping in a global variable, giving it a reliable, built-in translation table between virtual and physical memory spaces.

Bypassing Driver Signing Checks

To run its own malicious tools, the EDR killer must first bypass Windows’ driver signing enforcement. Normally, Windows uses a built-in verification check to block unsigned or blacklisted drivers from loading. The malware tricks Windows into disabling this gatekeeper using a simple swap:

1. The malware finds a specific kernel function and uses its physical memory map to pinpoint its location.
2. It commands the vulnerable driver to scan this memory area for a specific byte signature. This leads directly to the Code Integrity callback table.
3. Within this table, the malware locates the built-in verification check and “patches” it with a harmless, dummy function.

Blinding Security Products

With driver signing checks completely bypassed, the malware uses its read/write primitives to dismantle system callbacks, it identifies and targets:

• Process notify callbacks
• Thread notify callbacks
• Image load notify callbacks
• Registry callbacks and minifilters

Rather than conducting a blanket unlinking of all system callbacks, the EDR killer checks the address of each callback. If the address falls within a memory range owned by a security product on its hardcoded blacklist, Qilin surgically unlinks it by zeroing out the pointer with null bytes.

Next, the EDR killer drops and loads its own custom driver, which appears to Windows as purpose-built. Once loaded, the Qilin EDR killer gets all relevant running processes. For any processes running that match a hardcoded list, it stores the Process ID in a vector.

For every PID found, the malware sends a message to a driver. At a high level, the driver finds the full path of the target executable, makes it unreadable, unwriteable, and undeletable to any and all users, and then terminates the process.

Interestingly, the Qilin EDR killer performs a Discretionary Access Control List (DACL) modification on the target security product executable. The driver creates a new empty ACL header and sets the flag SE_DACL_PRESENT to TRUE. This is significant because a null DACL and empty DACL are not the same. A null DACL grants everyone access, whereas an empty DACL grants no access. This process makes it so that the security product’s executable can no longer be executed without needing to delete the file like other EDR Killers. Once the driver then terminates the executable, it can’t be restarted.

Once everything is completed, the EDR killer unpatches the Code Integrity Check to avoid triggering PatchGuard and then exits.

Defend Against Qilin Using Flashpoint

The sophisticated kernel-level manipulation highlights a rapidly expanding trend in the broader threat landscape: the proliferation of highly effective malware designed purely to disable enterprise-level security products. Qilin’s integration of these techniques demonstrates how the EDR killer market is maturing in the cybercrime underground, transitioning from a niche capability into a standard prerequisite for high-impact ransomware operations.

As security platforms continuously improve their detection mechanisms, Flashpoint believes the threat landscape surrounding anti-EDR tools will only grow larger and more aggressive, forcing organizations to focus on protecting the kernel and detecting rogue driver deployments. To learn more about Qilin and the latest advancements in ransomware, request a demo.

See Flashpoint in Action

Blogs

Blog

Understanding Illicit Ecosystems: How Dark Web Forums Structure Cybercrime

As part of our ongoing series, we analyze how dark web forums operate, breaking down Flashpoint’s tiered classification system and examining how specialized, hybrid platforms function together as an interconnected cybercrime supply chain.

When a high-profile data breach hits headlines, the default assumption is often to view the dark web as a single, centralized marketplace where any illicit service or tool can be bought. While many illicit forums aspire to be seen as a “one-stop shop,” the reality is that the underground economy relies on an interconnected network of specialized hubs that each align with distinct phases of the cybercrime lifecycle.

To understand how cybercrime thrives, it is vital to learn how these online spaces survive and how they play their parts in graduating threat actors from entry-level novices to sophisticated adversaries.

Navigating the Cybercrime Ecosystem: Entry Barriers and Forum Tiering

An illicit community’s survival hinges on its operational value and culture, which is ultimately created by its supporters. In a low-trust environment filled with cybercriminals, hidden law enforcement, and security researchers, these digital spaces are inherently defensive. To protect their communities from competitors’ attacks, surveillance, and eventual takedowns, forums implement rigorous gatekeeping mechanisms.

As such, Flashpoint organizes the cybercrime ecosystem into a tiered structure, separating them into low, mid, or top-tier forums, defined by several key factors such as: 

• Entry Barriers: The financial or reputational requirements for a user to join the community, indicating the forum’s exclusivity.
• Technical Expertise: The collective technical skills and proficiency of the forum’s members.
• Trade Quality: The quality and value of illicit goods and services exchanged, such as advanced hacking tools or high-value data leaks.
• Operational Security (OP SEC): The extent to which the community upholds strict security protocols and practices.

By analyzing these vectors, the ecosystem naturally separates into three distinct operational tiers.

Low-Tier Forums

These communities are easily accessible, often requiring a small fee or completely free registration with little to no vetting. They host less sophisticated users, beginner hackers, and minor data brokers seeking free material. Because the technical barrier is low, these spaces primarily share low-cost, high-volume data, including large data leaks, generic phishing guides, unchecked stolen accounts, and cracked software.

Consequently, these environments face a persistently high risk of scams and poor quality data. Within low-tier forums, reputation is often built by sharing free data or purchasing a rank or upgrade which is viewable by other users.

Mid-Tier Forums

Moderately accessible via both Tor and the clearnet, entry into these spaces typically require a vouch from an existing member, a minimal registration fee, or an initial deposit. These platforms concentrate on large-scale fraudulent activity and the exchange of various datasets—including bulk carding data, stolen credentials, stealer logs, phishing kits, botnets, and various malware.

The user base includes a mix of vendors, experienced threat actors, affiliates of larger groups, and aspiring cybercriminals looking for training. To protect users from internal fraud, these forums heavily prioritize integrated escrow services and reputation systems, which can be improved by purchasing an internal high-tier status.

Top-Tier Forums

These are highly exclusive platforms dedicated to high-value, highly technical, and targeted criminal operations. New applicants face a stringent vetting process, typically demanding either a formal invitation or a substantial registration payment. This exclusive layer hosts highly skilled, professional threat actors, malware developers, and key decision-makers within major illicit groups.

This is the ecosystem where adversaries build trust through valuable technical contributions or community reputation points and execute complex money laundering schemes, trade zero-day exploits, facilitate ransomware-as-a-service (RaaS) partnerships, and conduct large-scale initial access broker sales.

What Are the Different Types of Dark Web Forums?

Once a community establishes its tier, it usually functions as a specialized hub linked to a specific stage in the overall cybercrime lifecycle. They do this to cultivate talent and expertise, which naturally bridges communities together, creating a supply chain where different forums handle distinct operational and structural needs.

General Information and Community Boards

Modeled after surface-web sites like Reddit, these platforms serve as social and informational hubs. Discussions prioritize coordination, reputation management, and the propagation of best practices regarding OPSEC. Users share news about cybercriminal arrests, look for advice on how to remain anonymous, report potential exit-scams, and provide detailed reviews of specific vendors, particularly those selling illicit drugs.

Financial Theft and Carding Forums

These semi-structured environments blend marketplaces with social networks, utilizing a professionalized supply chain for selling stolen cards, dumps, and fullz. To reduce internal fraud, they rely heavily on reputation-building tools like verified seller statuses and integrated refund systems for invalid data. To ensure operational longevity, they are typically hosted on bulletproof infrastructure located in states that do not comply with international takedown requests, such as the Russian Federation.

Data Leak Forums

Depositories for stolen databases where raw breach information is structured into a tradeable commodity. Leaks are listed by victim name and sector, allowing actors to quickly find credentials or corporate records to repurpose for credential stuffing, extortion, or identity fraud.

Cracking and Hacking Tutorials (Knowledge Bases)

Existing entirely for knowledge exchange and offensive techniques, threat actors share methods, tutorials, fraudulent schemes, and bypass techniques, often encouraging educational sharing through competitions.

High-Skill Exploit and Access Forums

Top-tier platforms hosting the “upper echelons” of the community, such as initial access brokers, exploit developers, and malware creators. They rely heavily on strict arbitration systems, mandatory vendor deposits, and escrow mechanisms to safely conduct high-impact transactions and corporate intrusions.

Low-Barrier Retail Forum

High-traffic segments trading mass-market digital goods like cracked subscription accounts, premium software, and online gaming assets. Characterized by an exceedingly low barrier to entry and a relatively young user base seeking quick profit without the capability for advanced, complex operations.

Map the Illicit Pipeline Using Flashpoint

What makes the cybercriminal ecosystem truly cohesive is that the lines between these various types of forums and communities constantly blur. Most illicit communities are hybrid and transitional, intentionally or naturally blending categories to cater to each other’s needs and boost monetization.

Hybrid forums frequently connect the how-to tutorials with actual stolen data and network access, effectively creating a structural pipeline for threat actor progression. Platforms like BreachForums combine the attention-grabbing aspect of a data leak site with a structured marketplace for selling logs and other sensitive data. This type of hybridization allows a threat actor to progress from a beginner reading tutorials to an active criminal deploying stolen data.

Monitoring these fluid structures and transitions is the only way to understand how threat actors develop, and how the interconnected cybercrime landscape shifts over time. Therefore, it is essential for security teams to look beyond cyber threats as isolated, and recognize the multi-platform strategies these actors employ. Request a demo to gain visibility into these threat actor communities and proactively defend your organization from across the entire cybercrime supply chain.

Check out the rest of our “Understanding Illicit Ecosystems” series:

Understanding Illicit Ecosystems: The Hybrid Threat of “The Com”

Understanding Illicit Ecosystems: XSS and the Current State of the Russian-Speaking Underground

Understanding Illicit Ecosystems: Weaponizing Mainstream Apps and Social Infrastructure

See Flashpoint in Action