Peter Levashov Accused of FBI Collaboration and Running XSS Honeypot Forum After Kelihos Sentence
Former Russian spammer and botnet operator Petr Levashov, also known by the handle Petr Severa, faces fresh accusations of having worked for the FBI and of helping create a ransomware discussion forum that allegedly served as a honeypot.
Levashov was detained in Barcelona in April 2017. In September 2018 he pleaded guilty to operating the Storm, Waledac and Kelihos botnets. Although prosecutors requested 14.5 years in prison, he served less than three years. Specialists have long linked the unusually light sentence to cooperation with U.S. authorities.
Forum activity after release
After completing his sentence, Levashov stayed in the United States. On the XSS forum (domains xss.mx and xss.today) a user named bratva quickly became a moderator of the off-topic section. The account never engaged in commercial activity, a pattern consistent with forum rules that bar moderators from trading.
Another account, stallman, later surfaced on both XSS and Exploit.in. Stallman openly purchased network access to U.S. critical infrastructure, prioritising energy, water supply, hospitals and research laboratories. Forum moderators reportedly removed competing purchase threads while allowing stallman’s posts to remain.
Alleged connections and honeypot claims
Stylistic similarities and the shared nickname “golub” for a Telegram channel administrator have led investigators to connect bratva and stallman with Levashov. The same accounts defended Levashov in public threads while criticising other figures, behaviour interpreted by some observers as an attempt to maintain operational security or to keep the forums active.
Researcher Olga Kuprina noted that U.S. law-enforcement agencies may have operated or influenced these platforms to collect intelligence. The recent seizure of RAMP4u domains by the FBI in January 2026 is cited as further evidence that the forum had been allowed to operate under specific conditions.
While all claims remain based on open-source analysis and forum posts, the combination of lenient sentencing, selective moderation and continued high-value access trading has prompted renewed speculation that Levashov and associated accounts served U.S. authorities rather than purely criminal interests.
Related articles
Russian Cybersecurity Market Set to Hit 455 Billion Rubles by 2026 as Talent Shortage Persists
MWS Cloud forecasts that the Russian information security market will grow 20.8 percent to reach 455.4 billion rubles in 2026. The largest segment will be software at 216.5 billion rubles, followed by services at 167 billion and hardware at 71.9 billion rubles. Demand is increasingly driven by sophisticated attacks, regulatory requirements and fines rather than import substitution alone. BI.ZONE offers a more conservative estimate of 10-15 percent annual growth. Managed security services such as monitoring, incident response and vulnerability management are leading the services segment because few organizations can maintain 24/7 in-house teams. Director Artem Gribkov of Angara MTDR estimates the personnel deficit at approximately 40 percent, especially at middle and senior levels.
Russian Internet Users Report Growing Access Restrictions as Certificate Revocations Affect 39 Percent of Respondents
A recent telephone survey conducted by Russian Field between September 23 and 30, 2026, among 1,600 participants representative by gender, age, federal districts, and settlement types shows that 39 percent of Russian internet users have noticed restrictions or complications when trying to access websites. When sites fail to open due to certificate problems, 26 percent of respondents said they would simply stop visiting the resource. The findings, published by Kod.ru, also indicate that 57 percent of users are aware that Russian websites may not load in certain browsers because of revoked foreign certificates. In response to certificate errors, 55 percent would switch browsers, 22 percent would install the required certificates, and 21 percent would try accessing the site from a mobile device. Younger users are more inclined to use VPNs or proxies, while older respondents more often choose to abandon the site. Overall, 77 percent of those surveyed expect further changes to the Russian internet segment, with only 9 percent believing it will remain unchanged.
CISA and NSA Urge Shift to Memory-Safe Languages Like Rust to Eliminate Memory Vulnerabilities
Official reports from CISA, NSA, FBI and partners highlight that decades of safe coding practices and code analysis tools have failed to resolve memory safety issues in languages such as C and C++. Government documents cite statistics showing that 70-75% of exploited vulnerabilities and zero-days stem from memory errors, including data from Microsoft, Google Chromium, Mozilla and Project Zero. Google reports that Rust adoption in Android reduced memory-related vulnerabilities below 20% in 2025, with a 1000-fold lower vulnerability density compared to C++. The analysis details Rust's ownership, borrowing and move semantics that provide compile-time guarantees unavailable in C++, enabling stronger compiler optimizations. Reports also acknowledge migration challenges including learning curves, interop issues and ecosystem gaps, while noting ongoing C++ safety improvements targeted for C++26 and C++29. Major organizations including Microsoft, Amazon and Google are already committing to Rust for critical new code.
Russian CA TCI Integrates ACME Protocol to Automate TLS Certificate Issuance
The Technical Center Internet (TCI), part of RTK-COD, has deployed a production ACME server compatible with standard clients such as acme.sh, Certbot and lego. The implementation aligns the ACME state machine with the existing isolated signing infrastructure, Domain Control Validation mechanisms and mandatory Certificate Transparency logging to Yandex and VK CT logs. Certificate lifetimes are shortening industry-wide, with Web PKI limits dropping to 47 days by 2029, making manual issuance unsustainable. The service supports HTTP-01 and DNS-01 challenges, ECDSA P-256 keys and certificate revocation, while preserving the requirement for Subject/CN in CSRs and mandatory revocation reasons. A separate staging environment uses an internal CT log simulator for safe testing. Future plans include full multi-SAN support, ARI (RFC 9773) and removal of the Subject/CN restriction.