Who is RAMP's Administrator Stallman?

Dear blog readers,

This is Dancho.

A blog reader recently approached me with a very interesting and relevant analysis of RAMP's administrator Stallman where he's positive that he managed to identify his real world whereabouts.

Using a combination of publicly accessible information and OSINT cross-checking using both publicly accessible and proprietary data sets I decided to go ahead and do some additional research and publish his findings.

Here's the original research:

Subject: Stallman, administrator of the RAMP ransomware forum (seized by the FBI on 2026-01-28)

Also known as: admin (the forum's root account), Stallman (the public persona), Kajit / RED (the forum's earlier persona same hand, moderate confidence), axe1 (jabber persona), Stallman2 (DamageLib, per KELA)

Claim: Subject ran RAMP from the day it opened until the day the FBI took it, personally guaranteed its escrow at a 5% cut, bought US government network accesses at industrial scale while claiming a private cryptolocker of his own, and in writing offered to sell the deanonymization of the XSS forum's administrator to LockBit for 10 BTC.

Base identity: Not publicly recoverable. A native-Russian-speaking operator, behaviorally resident in the UTC+2/UTC+3 band, active 2021 through at least September 2025. No outlet, researcher, court, or law-enforcement body has ever published his name.

Method: Every claim below is anchored to dated, verbatim messages the subject typed himself forum posts, private conversations, escrow receipts or to public blockchain and network records. Public reporting is cited by outlet and date. Where a claim rests on inference rather than his own words or a hard record, it is labeled as such. No database identifiers are cited; what is shown is what a reader would see with the message open in front of them. How these materials came into the author's hands is not disclosed.

0. EXECUTIVE SUMMARY

On the twenty-eighth of January 2026, the FBI replaced the largest Russian-speaking ransomware forum in the world with a seizure banner and a winking cartoon bear. Within days, the forum's administrator appeared on a rival board to say goodbye. He did not deny what had been taken. He said the seizure had "destroyed years of my work," and then he said the thing that matters: he would keep buying network accesses, because his core business was unchanged. He is not arrested. He is not named. He is, as of this writing, still working.

This file is about who he is.

He ran the forum through two accounts a public face called Stallman and a root account called admin and the login record catches him switching between them on the same server, fifty-one seconds apart. Before he was Stallman, the forum belonged to a persona called Kajit a flamboyant, meow-signing operator whom LockBit publicly accused of being an informant, who was banned from the two biggest forums in the ecosystem, and who "sold" RAMP and vanished. Except: the jabber address stallman@ramp.systems existed on the operator's own private server six weeks before the sale, handed out by the Kajit-era account itself. The buyer's name was provisioned before the buyer existed. The evidence that Kajit and Stallman are one man who rebranded himself out of a burned identity is strong enough to state, and honest enough to label: moderate confidence, presented in full, next to the two-person version, which the public record also supports.

In his own words, dated, he told a stranger on 2021-11-22 what he was: «моя ниша это гос. доступы США. У меня свой приватный криптолокер.» My niche is US government accesses. I have my own private cryptolocker. He bought ten to twenty network accesses a day. He ran the forum's escrow personally and took five percent of every deal, and the Bitcoin ledger proves the arithmetic to the satoshi. His master wallet moved 55.84 BTC across three and a half years, touched Binance's hot wallet within one hop on both its inbound and outbound sides, and ended its life in January 2025 inside four enormous mixing transactions whose outputs are structured in powers of two.

He made one network mistake in 958 logged connections: a single cookie-login, on 2023-03-30 at 12:14:51 UTC, from a Verizon Wireless mobile address in the Philadelphia metro the only non-VPN, non-server IP he ever touched the forum with. Everything else was discipline: six VPN providers, Tor, a DigitalOcean VPS, and a clock he could not change. His sleep window, computed across 1,568 events, says he lives somewhere around Moscow time.

And on the first of February 2024, in a private conversation with the operator of LockBit eighteen days before Operation Cronos took LockBit down he offered, in writing, to sell the identity of the administrator of XSS, the forum at the top of the ransomware food chain, for ten bitcoin. «По факту да, могу дать инфу на него, скажем за 10 битков.» As a matter of fact, yes I can give you info on him, say, for 10 bitcoins.

Nobody has named him. This file assembles everything that can be assembled without a subpoena and then names the subpoenas: Binance, Verizon, GSL Networks, DigitalOcean, Namecheap, and a jabber server law enforcement has been holding since July 2025. His forum is in American hands now, and everything on it went with it. What this file is built from is not said. He is left to weigh the possibilities himself.

1. TWO ACCOUNTS. ONE OPERATOR.

RAMP "the only place ransomware allowed" opened to the public on 2021-11-01. Its account records hold the whole story of its ownership in two rows.

1.1 The account table

Field admin Stallman

email admin@forum.com (placeholder) stallman2@thesecure.biz

registered 2021-10-18 14:45:28 UTC 2021-11-01 23:33:54 UTC

staff groups 3 + 4 (administrator) 4 (staff)

timezone set Europe/London Atlantic/Reykjavik

public posts 70–75 5

private threads hundreds (535 messages) 23 threads (59 messages)

last activity of record 2024-02-01 2023-04-17

Read the registration dates. The admin account was created on 2021-10-18 two weeks before the public opening, the founding operator's root account. The Stallman account was created on launch day, 2021-11-01, in the forum's first hour. One built the house; the other walked in with the first guests. As Section 2 shows, 2021-10-18 is not just any date: it is the exact day outside researchers recorded the forum's leadership changing hands. The man who would later call himself Stallman was inside the forum's machinery before the forum had a single member.

1.2 The declaration, in his own hand

On 2022-07-01, posting as admin, the operator made the identity explicit to the entire forum:

«Теперь Я владелец и админ этого форума теперь, использую аккаунт @admin, Stallman»

(Now I am the owner and admin of this forum; I use the account @admin, Stallman.)

No username-change record exists for either account. This is not a rename; it is one man signing his root account with his public name.

1.3 The fifty-one seconds, 2023-04-17

Words can be theater. The login record cannot. On 2023-04-17, every event below came from a single DigitalOcean VPS, 68.183.153.132 the forum's management server:

21:47:30  admin     login

21:48:21  Stallman  login            <- 51 seconds later

21:49:27–21:49:52  Stallman  4 private messages sent

21:51:16  Stallman  avatar_delete    <- wiping the persona's profile

21:51:21  Stallman  account_details_edit

21:51:35  admin     login            <- back to the root account

21:52:57  admin     private message sent

One keyboard. A man logged out of his root account, logged into his public persona, answered four waiting correspondents, deleted the persona's avatar, edited its account details profile hygiene logged back out, and resumed being admin, all inside six minutes. That Stallman session is the account's last activity ever recorded. The public face was retired in place, sanitized, and never used again.

His own messages to the four correspondents that evening say the same thing in words: «пиши мне на аккаунт @admin сюда не захожу» write to me on the @admin account, I don't come in here anymore.

Confirmed: admin and Stallman are one operator, from at latest 2023-04 through the end of the record and, as the next sections show, from much earlier.

2. BEFORE STALLMAN: THE FORUM'S FIRST LIFE UNDER KAJIT

Every account of RAMP's ownership the forum's own staff, the public researchers, and the man who created the forum tells the same story with the same gap in the middle. The gap is where this file lives.

2.1 The ownership chain, as the public record tells it

RAMP's creator is a known quantity: Mikhail Matveev, publicly identified, indicted by the US DOJ in 2023, reported arrested in Kaliningrad in November 2024 the man behind the handles Orange, Wazawaka, and BorisElcin. He built RAMP in July 2021 on the Tor infrastructure that had hosted Babuk's leak site, then Payload.bin (McAfee Enterprise ATR / Intel 471 / Coveware joint reporting, via BankInfoSecurity, 2021-09-09). The same reporting names the staff: Orange as admin, with "other known actors MRT, 999 and KAJIT serving as moderators."

On 2021-10-18, the leadership changed. Juan Antonio Velasco of Santander, presenting at Group-IB's CyberCrimeCon 21 (The Register, 2021-12-02): "They all changed jobs on October 18. Orange, MRT, and 999 decided to go private, while Kajit was named the admin of Ramp. Kajit has also launched a redesign of Ramp."

Now read Section 1.1 again. The admin root account was registered 2021-10-18 14:45:28 UTC the exact day an outside researcher, presenting contemporaneous monitoring, says Kajit was named admin. The "redesign" Velasco described is the XenForo forum this file is built on. The Kajit era and the admin account were born on the same day, at the same event. (Strong.)

Matveev himself, interviewed by The Record (Dmitry Smilyanets, 2022-08-25), describes the handover in his own words and settles a researcher conflation in passing:

"All these nicknames, except one, are mine. I have never been Kajit. … It was there on the forum that I met Kajit. I said to Kajit, 'Hey, be a moderator, verify everyone, and I will toss some cash your way.' That's how the forum actually fell into the hands of Kajit. … I hit the bottle hard and didn't have time for the forum at all, so I gave the forum to Kajit."

2.2 The fall of Kajit, November 2021 – January 2022

Kajit lasted three months. The public record of his destruction is unusually complete, and it matters here because of what it did to the name.

KELA, "Beware. Ransomware." 2021 annual report (published ~March 2022): LockBit's representative "stated that 'watchers' are everywhere and has made several claims against the RAMP forum and its admin, KAJIT, suggesting that he may be linked to law enforcement." After the January 2022 REvil arrests, "LockBit published on XSS a conversation with one REvil member from early November to prove that KAJIT collected information on REvil and may be responsible for their takedown." LockBit further "disclosed conversations with KAJIT and vx-underground … to prove that KAJIT leaked a screenshot of an admin panel belonging to the BlackMatter ransomware operation." KELA's conclusion: "Following LockBit's efforts, KAJIT was banned from XSS and Exploit and resigned from RAMP administration."

Analyst1, "A History of REvil" (Jon DiMaggio, 2022-01-27): LockBit believed REvil's operator 0neday was compromised and that "RED \ KAJIT was to blame," an administrator on another forum.

secrss.com (2022-01-21), relaying the 0neday–LockBitSupp chat log via observer Azim Khodjibaev: RAMP's new administrator "Red (aka Kajit)" had "hacked REvil's server admin control panel," and LockBitSupp "believed he was working for the FSB," feeding them evidence.

own.security (Orange Cyberdefense, Chapter II, 2024-01-11) adds the counter-reading that any honest file must carry: after Kajit's departure, "Mr. Matveev chose to undermine the forum for unknown reasons. He disseminated rumors through representatives of LockBit and BlackMatter RaaS, and the administrator of the prominent RLCF 'XSS,' suggesting that KAJIT was an agent of law enforcement." Under this reading, the informant campaign was at least partly a grudge, manufactured by the man who had given the forum away.

Inside the forum, the same story was told in smaller words. The forum's own infrastructure builder the account Support, whose full testimony appears in Section 11 wrote to the admin account on 2022-02-05:

"Some people say what Kadjit work in FBI/police/or other stuff. This very very bad for forum reputation."

"Kadjit is very strange. No have any skills. Only says beautiful words."

And a forum member, Анальгин, wrote to the admin account on 2022-08-16 with the identity chain in one sentence:

«Мой токс ниже. 518887D… Твой тока у меня уже есть. Ник RED, он же KAJIT.»

(My TOX is below. 518887D… I already have yours. The nick RED, a.k.a. KAJIT.)

Three independent public sources (KELA, Analyst1, the Khodjibaev-relayed chat log) and the forum's own members agree: the administrator of RAMP in late 2021 answered to Kajit, and also to RED.

2.3 The brokered transfer

How the forum passed from the burned Kajit to Stallman is the hinge of everything, so here is the public version first, on the record:

Matveev (The Record, 2022-08-25): "The damage [XSS] forum administrator suggested to Kajit to transfer the forum to someone else, and as far as I know, Stallman got it. … I don't go there, and I didn't have much contact with Stallman."

cybercrimediaries / own.security Chapter III (2024-02-08), citing the January 2022 XSS thread: "'LockBitSupp' got the upper hand as 'KAJIT' got banned and the 'XSS' administrator advised 'KAJIT' to sell his forum 'RAMP' to the threat actor 'Stallman', because no one trusted him anymore."

The same chapter's Figure 14 caption: "Stallman, the present administrator of RAMP, refutes the accusations of LockBitSupp against KAJIT and reaffirms that RAMP is not under the control of police." In January 2022 before the transfer was formal Stallman was already publicly defending Kajit on XSS.

CloudSEK ("The Rise and Fall of RAMP," 2026), reading the same material this file is built from: "Stallman took over from Kajit," and crucially the wallet cluster attributed to Stallman went "first active on January 4, 2022, shortly after Stallman took over."

Note the date. The public drama the ban, the resignation, the advice to sell played out across January 2022. The forum's escrow wallet sprang to life on 2022-01-04, at the very start of that month. The operational takeover did not follow the theater. It preceded or accompanied it. (Confirmed as dates; interpretation follows in Section 4.)

2.4 The ghost: honey, Khajit, and 5 August 2023

One more name belongs in the Kajit file, because it shows how layered the persona was. CloudSEK's reading of the forum's private messages: a user called honey was "the previous admin's close partner and collaborator. Honey actually went by the name of Khajit as well." The early messages between honey and the admin account "paint a vivid picture of the pre-Stallman era: late night conversations, networks being locked with Babuk ransomware, and chaotic lifestyle choices."

In February 2023, honey resurfaced from a friend's account; Stallman refused to recognize him without authentication through the original secure channel. Then, in October 2023, a message arrived from honey's account:

"This is not Khajit, this is his partner. We share this account. Do you know something about him? He disappeared about 5 August" [2023].

Nobody no researcher, no outlet, no forum has publicly explained what happened to the man behind the honey/Khajit identity after 2023-08-05. A RAMP co-operator, with Babuk-era hands-on locking experience, vanished and stayed vanished. (Moderate: secondhand CloudSEK's account; the disappearance itself is quoted from the message.) The partner who asked the question was asking Stallman.

The name itself is a tell, though a soft one: "Kajit/Khajit" is a respelling of Khajiit, the feline race of The Elder Scrolls which is why the Kajit-era account signed messages "meow." (Speculative as etymology; the meow signature itself is verbatim in the record, next section.)

3. THE HINGE: «жабу скину stallman@ramp.systems»

The identity link between the burned Kajit and the triumphant Stallman was not confessed. It was betrayed by logistics by the operator's own contact addresses, handed out in his own typing, weeks apart.

3.1 The private jabber server and the name that existed too early

On 2021-12-06, the admin account the Kajit-era hand wrote to a contact about infrastructure:

"I need ramp.systems - namecheap account. password wrong"

The operator had registered a private domain, ramp.systems, at Namecheap, and was running his own jabber server on it. Five days later, on 2021-12-11, the same account handed out two jabber addresses on that server, in two parallel conversations.

To one correspondent:

«жабу скину stallman@ramp.systems которая»

(I'll give you the jabber stallman@ramp.systems.)

To another, the same day:

"I just chage the jabber dude dm me here - kajit@ramp.systems … meow-meow, kajit has a lot to do, and a lot was done"

"its my new private jabber. dont share pls"

Read the first one again, slowly. On 2021-12-11, the forum was still publicly Kajit's. The "sale" to Stallman was weeks in the future the ban drama had not even peaked. And on the operator's own private server, in the operator's own typing, there already existed a provisioned jabber account named stallman@. The name of the man who would supposedly buy the forum in late January was configured on the seller's own server in mid-December, on the same host as kajit@, the address the operator called "my new private jabber."

There are two ways to read that. Either Kajit was already preparing the handover account for a specific successor which requires that the successor was selected, and his identity built, before anyone had advised selling anything or the buyer and the seller were the same man, and the new mask was being cut from the same cloth as the old one. Both readings are on the table in Section 4. What is not contestable is the fact: stallman@ramp.systems existed, on the operator's private server, before "Stallman" had taken anything over. (Confirmed.)

A footnote that makes the fact harder to wave away: the Stallman forum account was registered 2021-11-01 launch day, five weeks before Kajit's public fall even began, and it was registered with the email stallman2@thesecure.biz. The Stallman identity was not a rescue improvised in January 2022. It was pre-positioned from day one: the forum account in November, the jabber in December, the takeover in January.

3.2 The meow and the KJ

The Kajit-era writing has a flamboyant signature, and the record shows exactly where it lived and exactly when it died.

The admin account signed exactly two public posts with initials and a full review of everything ever written on the forum shows those initials occur nowhere else, from any user:

2021-11-22: «Жду в пм. Удачи и всех благ. KJ» (Waiting for you in PM. Good luck and all the best. KJ)

2021-12-10: "welcom to club baddy. We need to prepare some surprise to feds. Marry Christmas soon KJ"

KJ Kajit signing the root account's posts. The era's other signatures are just as loud: "meow" as a life-sign ("meow ( Its just meow - showing Im alive and free )"), a mantra that appears only in Kajit-era text anywhere in the record "Stay strong - work hard- u can any - just need time. cyber"; "Dw. We can any. Just need time" mock-philosophy («лучше лухри в Барнауле чем, электрический стул в Калифорнии…», better luxury in Barnaul than the electric chair in California), a Chinese poem quoted into a public post, and a texting-English so broken it is a dialect of its own: "U need a send me builds u locker for test."; "Thx a lot my little bro. Awesome Article. Community very appreciate it"; "coz Admin of RAMP very like u photos and u style of thinkings"; "man Iam preparing a group rn. 3 peoples in it"; "too many works rn. I dm u late"; "freind reqest sent"; "fuckin fsb wanted catch up me."

Every one of those markers the meow, the KJ, "u can any," the flamboyance vanishes completely from the admin account after 2022-01-28. The account's writing from February 2022 onward is disciplined, formulaic, businesslike. One of two things happened at that boundary: the account changed hands, or the man changed his mask.

3.3 The takeover story, told four different ways

When a story is true, it tends to be told the same way twice. The operator told it four ways:

2022-02-02: "it's the same Stallman here now"

2022-02-03: «Привет, да, теперь это мой аккаунт. начало этой беседы вы вели не со мной, и его больше нет, он забанен.» (Hi, yes, this is my account now. You started this conversation with someone else he's gone, he's banned.)

2022-02-10: «ну я не Каджит, надеюсь ты это понимаешь? Первый рамп писался не для меня. Его больше нет, форум теперь мой.» (Well, I'm not Kajit, I hope you understand that? The first RAMP wasn't written for me. He's gone, the forum is mine now.)

Another correspondent, same window: «я полностью забрал форум, его больше нет» (I took the forum over completely, he's gone.)

And in a later promotional text: the forum «был выкуплен мной лично у прошлой администрации несколько месяцев назад» (was bought out by me personally from the previous administration several months ago.)

He was banned. He's gone. I took it. I bought it months ago. The mechanics of the supposed transaction shift with the audience sometimes a seizure, sometimes a purchase, sometimes an erasure. And in one of them the 2022-02-10 message he protests "I'm not Kajit" to a correspondent who had not asked. Meanwhile the staff who worked the forum every day kept treating the two as one person: the moderator chaindel writes «мне Каджит заплатил 400 дол» (Kajit paid me 400 bucks) and, in the same message, dated 2022-05-17, «Привет Стэлман, я вроде как вернулся» (Hi Stallman, I'm sort of back) addressing the same account by both names in one breath.

3.4 «kajit, its u??»

The most direct testimony comes from the forum's own staffer vAz a young exploit developer, close to the operator, who had himself been raided by police. On 2023-04-22, fifteen months after the supposed handover, he wrote to the admin account:

"shit, after getting raided. but all ok now. i have left the country and starting back again. kajit, its u??"

A staff member, in private, asking the administrator point-blank whether he is Kajit in April 2023. The reply preserved in the record deflects. It does not deny.

4. ONE HAND OR TWO? THE QUESTION THE FORUM ITSELF ASKED

This is the load-bearing question of the file, and it will not be dodged. The public record Matveev, cybercrimediaries, CloudSEK treats Kajit→Stallman as a sale between two people. The evidence inside the forum's own record says the "sale" may have been a rebrand. Here is both cases, in full, with the assessment at the end.

4.1 The case for ONE hand (Kajit == Stallman)

1. The pre-provisioned name. stallman@ramp.systems existed on the operator's private jabber server on 2021-12-11, handed out by the Kajit-era account, weeks before the public fall and the Stallman forum account existed from launch day, 2021-11-01. The successor's identity predates the succession. (Section 3.1; confirmed as fact.)

2. Shared idioms across the "two" men found from no one else on the forum. A full sweep of every user's posts and private messages: the formula «…сначала давай свою, иначе … не добавлю, спаммеры заебали» occurs only from the Stallman account (twice, early 2022) and the post-takeover admin account (once, 2023-09-24) the same sentence, typo variants included, four and twenty months apart. "Thank you for your service" occurs only from Stallman (once) and admin (twice). The access-buyer's bark «Поймал» ("caught it" I grabbed the deal) occurs only from Stallman («Поймал, сколько хочешь за него?») and admin («ага, поймал.»). Kajit-era «велком» resurfaces in a Stallman-era message. If two people, the buyer absorbed the seller's rarest verbal tics and nobody else on the forum had them.

3. The same dialect of mistakes. Both eras and both accounts share the same systematic error classes: dropped soft signs («равнь»), -тся/-ться confusion («обратится к Гаранту», boilerplate), vowel swaps («заявленно», «Провереный», «по английски», «вообщем»), double consonants («рекоммендую», «доллларов»). Individual errors are common; the constellation is a fingerprint, and it is one constellation.

4. The same reflex: policing other people's Russian. The Stallman account: "what is your native language, bro? your russian is no good." The admin account, years later: «Я ничего не понял, бро. Пиши по английски, если русский не родной, отделяй разные предложения точками.» (I didn't understand a thing, bro. Write in English if Russian isn't your native language; separate your sentences with periods.) Both personas correct their interlocutors' Russian like schoolmasters. Same man, same tic.

5. Motive for theater. Kajit was publicly burned accused by the biggest crew in the ecosystem of working for the FSB or the FBI, banned from XSS and Exploit. A persona that toxic cannot run a trust business. A staged sale to the forum's own already-trusted escrow man, "Stallman," launders the identity without surrendering the asset. And note the convenience: the buyer and the seller are exactly the two accounts one operator demonstrably controlled (Section 1).

6. The staff never bought it. chaindel's single-message Kajit/Stallman conflation (2022-05-17); vAz's point-blank "kajit, its u??" (2023-04-22); Анальгин's «Ник RED, он же KAJIT» addressed to the admin account as late as August 2022.

7. The January 2022 defense. Per cybercrimediaries' Figure 14, "Stallman" publicly defended Kajit on XSS during the ban dispute. Under the one-hand reading, that is a man vouching for himself in his next mask. Under the two-hand reading, it is a buyer protecting his purchase. Both fit; only one requires a second human.

4.2 The case for TWO people

1. First-person purchase statements, repeated. "It's the same Stallman here now." "I'm not Kajit." "I bought it from the previous administration." Explicit, repeated, to multiple audiences. They can all be cover but they are the direct testimony in the record, and a fair file says so.

2. The register shift is real. Kajit-era text is flamboyant meow, KJ, Chinese poetry quoted in a public post, "u can any," XD laughter. Stallman-era text is a business machine. Every one of the loud markers disappears at the boundary and never returns. That is the strongest single counterpoint though it is equally explained by a deliberate persona change by a man who knew, better than anyone, that researchers and his own staff compared writing styles. He ran a forum. He watched style-analysis happen to other people.

3. The witnesses say two people but they only repeat what they were told. Support and chaindel both speak of Kajit and Stallman as two. Both left the team at or before the transition. Neither claims to have met either man.

4. CloudSEK's honey/Khajit reading. If "Khajit" was at times a shared handle between the admin and his partner honey (Section 2.4), then the name itself was already communal property which cuts both ways: it makes the Kajit identity more constructed, not less, but it also gives the two-hand camp a real second body.

4.3 Assessment

Moderate confidence that the Kajit-era admin account and Stallman are the same hand one operator who ran the forum from its October 2021 rebirth to its January 2026 death, under three sequential personas: Kajit-the-admin, Stallman-the-Guarantor, Stallman-the-owner. The load-bearing items are the pre-provisioned stallman@ramp.systems jabber, the launch-day Stallman account, and the shared idioms found from nobody else on the forum; they are the kind of fact that theater cannot easily produce, because they were laid down before anyone was watching for them. It is not provable from text alone, and this file does not claim it is. If two men, then the second man arrived with the first man's private server, his private vocabulary, his escrow wallet within days, and his staff's unshakable suspicion a handover so seamless it is indistinguishable from a rebrand, which is its own kind of answer.

Either way, from February 2022 forward the question closes itself: the admin and Stallman accounts are provably one operator, and that operator is the man the FBI's banner addressed.

5. THE OPERATOR IN HIS OWN WORDS

Strip the names away and the forum record still contains a full professional self-portrait what he sold, what he bought, what he built, and what he was afraid of. All of it dated. All of it his.

5.1 The niche: US government accesses

Three weeks after launch, in a private message dated 2021-11-22, the man behind the Stallman account described his real business not the forum, the business the forum served:

«моя ниша это гос. доступы США. У меня свой приватный криптолокер.»

(My niche is US government accesses. I have my own private cryptolocker.)

One sentence, two confessions: an initial-access broker specializing in US government networks, and a ransomware operator running his own private locker not renting a RaaS seat. He repeated the second half elsewhere, in the Kajit era: «локер у меня свой… пп локер не юзаю» the locker is my own… I don't use affiliate-program lockers.

Publicly, he was the forum's standing buyer. His access-purchase ad, first posted 2021-11-10 and reused verbatim for years across both his accounts:

«С радостью выкуплю Ваши доступы… я покупаю доступы»

(I will gladly buy out your accesses… I buy accesses.)

The scale, in a private message from 2023: he was buying "10-20 access per day now." And the targeting, in a detail he gave a partner after being burned: a victim box at 72.45.245.26 with administrator:Password1 weak-credential US government machines were his supply line. (His staffer vAz, in the same ecosystem, exposed a US FortiGate at 45.46.19.111, Town Manager:Password1. Same shelf, same store.)

5.2 The crew, and the deployment claims

He was not only a broker. In the Kajit era, from the root account, dated 2021-11-20, he described building a working crew:

"man Iam preparing a group rn. 3 peoples in it. They will hack networks for me and I will teach them"

And three weeks later, deployment claims of his own, dated 2021-12-10:

«Сети ставлю от 100кк+(только) щас готово два 1ккк+ на простановку»

(I deploy on networks from $100M+ revenue only; right now two $1B+ targets are ready for deployment.)

"Ставлю" I install on nine- and ten-figure networks. Grandiosity is the house style of these forums, and a fair file discounts it; but the claim is specific, operational, and paired with his TOX contact in the same message. He also described owning a stealer with a delayed, anti-analysis command loop: "my stealer will connect to my private server after 24 hours… only if there is 2 hours no mouse movements." That is not a buyer talking. That is an author.

And the old history, given as gossip but worth keeping: «Если у тебя есть дамп старого рампа… был даа - он борю шваркнул. он ему под есхи локер писал и пропал» If you have a copy of the old RAMP… there was one Borya whacked him. He wrote an ESXi locker for him and disappeared. An earlier RAMP incarnation, destroyed by "Borya," and a locker writer who vanished. (Anecdotal his own words, secondhand.)

5.3 The Guarantor: escrow as a personal business

On 2021-11-25, the forum announced its Guarantor-Service escrow for every deal on the board "represented by me personally," first contact by PM, then jabber or TOX. The man behind that sentence was the Stallman account: the escrow was his hands, his wallets, his five percent.

The private-message workflow, preserved in dozens of threads, ran like this (buyer-side arithmetic, verbatim):

"0.063 + 5% = 0.06615 BTC … when seller sees payment in blockchain, release the goods."

"0.17 + 5% = 0.1785" (2022-01-03)

"0.20582992 + 5% = 0.216121416 BTC" (2022-01-13)

Every deal, five points, paid to addresses he supplied. Section 10 shows what the blockchain did with those numbers they match to the satoshi.

His rules of engagement were just as consistent. Jabber first, always: «Привет, есть жаба. Давайте сначала свою, иначе не добавлю все равно, спаммеры заебали» (Hi, I have jabber. Give me yours first or I won't add you anyway spammers have fucked me raw). TOX was rationed: «токс даю после пяти успешных сделок» (I give my TOX after five successful deals); «Я не использую токс, только жабу… сорри, ресечеры заебали» (I don't use TOX, only jabber sorry, researchers have fucked me raw). Note the compartmentation: the man who "doesn't use TOX" held at least three TOX identities of his own (Section 11.2). The anti-researcher stance is not a preference. It is a perimeter.

He verified counterparties cross-platform by making them write to his accounts on other forums: «отпиши мне на экспе, акк Stallman, что это ты» (write to me on Exploit, account Stallman, that it's you); «Мой акк на экспе @Stallman» (my account on Exploit is @Stallman). His public name was his passport across the ecosystem Exploit, XSS, RAMP, and per KELA, Rutor and Runion too.

5.4 The money talk, and the FSB

Two small confessions about money. To a counterparty reassuring him about tainted coins: "My bitcoins is white as hell," signed off "Have a good day, brother." And the scale of his everyday arithmetic: «1к это хороший ужин в ресторане» a thousand [dollars] is a nice restaurant dinner. A man for whom $1,000 is a meal.

And the state. In the Kajit era, in a burst of broken-English candor: "fuckin fsb wanted catch up me." CloudSEK's long-form reporting documents a second episode it titles "The FSB Admission": asked by a confidant why he had been unreachable, "the admin's response was blunt" (the underlying quote survives only as a screenshot), and the confidant's advice was preserved in text: "Fly low. Encrypt all your computers, save those hard drives somewhere not your usual home and put a new HDD full of pictures of cats." (The advice: confirmed text. The admission it answered: moderate screenshot-only, but consistent with the rest of the record.)

Read the pair together. A man the FSB "wanted to catch up," whose friends coached him on disk hygiene and decoy drives operating inside Russia's jurisdiction, afraid of Russia's police, while running the world's most visible ransomware market. That is the classic position of the Russian cybercrime operator: tolerated until noticed. It is also, as Section 13 shows, exactly the accusation his enemies inverted after the seizure.

5.5 The forum as a business

The forum itself was run like a shop, and the till receipts survive in his messages. Banner ads at $1,500 a quarter; a $200 vendor-verification fee with its own dedicated wallet (bc1qlkltu…, Section 10.1); a content-writer salaried at $500 a month and an approval clerk at $200, later $350, paid in BTC to the clerk's own wallet. He bought promotion the way his members bought accesses mass jabber spam blasted through both criminal providers' user bases, in his own words: "i am working on jabber mailing on expoit.im and thesecure.biz"; "I have ordered jabber ads on exploit and xss jabbers on 8th of march". The spam vendor he paid is a live identification vector: it knows his paying jabber and wallet.

And he gave product away when it suited him. His free-posting formula to vendors «размещайте на здоровье… Это бесплатно» (post away, you're welcome… it's free), repeated across years was copied so faithfully by his own approval clerk that the clerk's relays of it are the only other occurrences anywhere. Even his employees quoted him. When the forum's guarantees were questioned, he vouched with deposits on the neighboring board: «На соседнем борде внесен деп 1BTC (exploit.in)» (a 1 BTC deposit was placed on the neighboring board, exploit.in) buying credibility on one forum with money staked on another, the escrow man's native move.

6. TEN BITCOIN FOR A HEAD: THE LOCKBIT FILE

In late January 2024, the biggest ransomware brand in the world was feuding with the biggest forum in the world. LockBit's representative had been banned from XSS public reporting (Trend Micro; govinfosecurity, February 2024) describes the cause as his refusal to pay the broker michon's 10% cut on ransom settlements. The banned man came to RAMP's administrator. What followed, preserved in a private conversation running 2024-01-31 → 2024-02-01 (all times UTC), is the single most remarkable exchange in the record the moment the operator of one criminal institution offered to sell the head of another.

The full chronology, from the principals' own typing:

When From Content (translated)

2024-01-31 21:05 admin "There's a toad [a greedy broker] here? People are starting to write that you must be banned. Let's try to solve the XSS ban issue through me, so you don't lose all your accumulated rep and your brand."

2024-01-31 21:27 LockBit "No toad and never will be; I stated my position in arbitration. There was no contract. The XSS admin himself wrote that. On his instruction I won't pay a percentage to anyone. And for leaking info to the public without private arbitration even for 'purchased access' I won't pay. If you think I'm wrong, you may ban me on his orders too."

2024-01-31 22:16 LockBit "Do you happen to have the XSS admin's deanonymization? I can buy it."

2024-02-01 02:47 admin "I can help and become the mediator between you and Tokha, if you get a bit more flexible. Give TOX… let's try to find a way out without nerves." (His «погибче», "more flexible," preserved as typed.)

2024-02-01 02:52 admin "As a matter of fact, yes I can give you info on him, say, for 10 bitcoins. But better to do it differently: settle up you pay something, he unbans you, and we'll be friends as families."

The Russian of the last line, for the record: «По факту да, могу дать инфу на него, скажем за 10 битков. Но лучше по другому: рассчитайтесь ты чтото платишь, он тебя разбанивает, и будем дружить семьями.»

Read what is being sold. Tokha Toha is the administrator of XSS.is, the forum that sat at the top of the Russian-speaking cybercrime supply chain for two decades. LockBit, freshly banned by him, wanted his real identity badly enough to ask for it by name and price. And the administrator of RAMP answered not with outrage but with a number: 10 BTC roughly $430,000 that week. He claimed to hold, and to be willing to sell, the deanonymization of the most powerful forum operator in the ecosystem. (Confirmed as a claim made in writing; whether he truly possessed the dox is unverifiable the offer itself is the fact.)

Context makes it worse, or better, depending on which side of the subpoena you sit on. KELA's later reporting (2025-09-04) independently documents the feud from the other side: LockBit had made personal threats against Toha and his family, and a forum member was publicly demanding to know why Stallman, as RAMP admin, had not banned LockBit over it. So when the RAMP admin offered Toha's identity to the man making those threats, he was not brokering gossip. He was pricing a target package for a crew that had already threatened the target's children while in the same breath offering to mediate and proposing everyone "be friends as families." The phrase «дружить семьями» occurs exactly once in the entire record. He coined it for the occasion.

LockBit never answered. His last activity on RAMP is timestamped 2024-02-01 02:36 UTC minutes before the admin's final overture. Eighteen days later, on 2024-02-19, Operation Cronos seized LockBit's infrastructure. And two years later, when RAMP itself was seized, the underground's first rumor about its administrator was per Rapid7 (2026-02-25), flagged as unsubstantiated that Stallman had tried to sell the forum's database for 10 BTC. The same price. His signature number, attached to his own head this time.

One more LockBit artifact belongs in the file, because it shows whose company the operator kept. LockBit's single public RAMP post, dated 2023-12-17, delivered in the house doctrinal voice after a rival program exit-scammed:

«Такая же учесть ждёт любую партнёрку, где выплаты идут на кошелек партнёрки, а не на кошелек адверта. Выплаты на кошелек адверта были, есть и будут только в одной партнёрке.»

(The same fate awaits any affiliate program where payouts go to the program's wallet rather than the advertiser's wallet. Payouts to the advertiser's wallet were, are, and will be in only one affiliate program.)

The man who ran RAMP escrowed deals between that man and everyone else, took five percent, and when the moment came offered him a dox at ten coins. This was not a forum administrator in the neutral-venue sense. This was a broker of everything, including people.

7. THE FINGERPRINT: HOW HE TYPES

A man can rotate accounts, jabbers, wallets, and VPN exits. He cannot easily rotate the way he misspells. Across 674 dated texts from the operator's two accounts roughly 49,000 characters of posts and private messages one stable linguistic fingerprint emerges, and it survives every costume change in the record.

7.1 The Russian signature

Systematic, recurrent error classes not one-off typos but a personal dialect of mistakes:

Dropped soft signs: «равнь», «Будте», «получшь».

-тся/-ться confusion: the escrow boilerplate itself «обратится к Гаранту» repeated verbatim for years; «не хочу ошибится» in his standing buy-ad.

Vowel swaps: «предворительно», «заявленно», «Провереный», «варинты», «соотвествует», «просморов», «притензия», «покупателях», «арувом» / «апрувну» his rendering of English "approve."

Double-consonant inventions: «рекоммендую», «доллларов», «работеннки».

Colloquial spellings inside "official" texts: «тоесть», «дэмаге», «экспе», «хсс», «блэк», «хош», «че», «ща», «канеш», «хз», «норм», «пох».

The fluency markers run the other way this is a native speaker, not a learner. He deploys slang morphology effortlessly («пиндосы»), writes New Year addresses as «дорогие форумчане», and the tic already noted corrects other people's Russian from both accounts. A man does not schoolmaster a language he is unsure of.

7.2 The catchphrases that exist nowhere else

A full sweep of every user's posts and private messages for the operator's signature strings. The hits come back to his two accounts and nobody else's:

Marker phrase Occurrences Who

«…давай свою, иначе … не добавлю, спаммеры заебали» 3 Stallman ×2 (early 2022), admin ×1 (2023-09-24)

"Thank you for your service" 3 Stallman ×1, admin ×2

«Поймал» (access-buyer's "caught it") 3 Stallman ×1, admin ×2

«дружить семьями» 1 admin (the 10-BTC offer, 2024-02-01)

"KJ" sign-off 2 admin, Kajit era only (2021-11-22, 2021-12-10)

"u can any" 1 admin, Kajit era only

«берегите себя» 1 (+1 variant) admin, Kajit era

No third account inside RAMP shares a single one of his marker phrases. (Moderate-strong: if he ran another talkative persona on his own forum, it avoided all of his verbal tics and his tics are not subtle.)

The sentence structure is its own signature: clipped one-word admin-actions as messages "done", «принял» (accepted), «прибанил.» (banned him), «почистил» (cleaned up), «оплачено до 24 февраля 2024» (paid up through Feb 24, 2024) trailing ellipses, Russian-style ")" smileys, and a habit of pasting his own jabber logs into private messages with the nick prefix <Stallman> confirming that "Stallman" was his jabber name as well, not merely a forum costume.

7.3 The English signature

Fluent enough for business, broken in a stable, personal way:

Agreement and articles: "All deal are uniq", "how many people has it", "My bitcoins is white as hell", "it's a night time here", "money on the way".

His personal misspelling shelf: "appoved", "againt", "acticated/actvated", "prepearing", "definately", "registartion/registarations", "porpose", "inretested", "controllibg", "appriciate", "alreaady", "nothinh", "havn't", "unbaned", "remeber", "messsage", "analysys", "resore".

Formulaic closures: "Have a good day, brother.", "Stay safe.", "good job, thanks".

7.4 The password habit a fingerprint in his opsec itself

Even his throwaway secrets carry a signature. Passwords he generated for users and services, verbatim from his messages:

LSIUGF932P$$*123pt

LSKJGHW&($gt208bpeaw74

LSHDLfg27o*^&FAg2fo87r2

LSKGHJdf3o748!

LSIYDftp794qt334q8o7

Five random-looking strings, and four start with LS. (Two more start with K/G: "KGFQ@#*^&…", "KGYVUSVFo4782%23", "LJH3240@w3glss".) A generator with a personal seed habit or initials. If any password-mash of this shape ever surfaces attached to a real account, it is a string worth pulling. (Confirmed as habit; what L and S stand for is speculation this file will not indulge.)

7.5 The staff are not him and one of them is no one

The fingerprint was tested against every plausible internal candidate. Each is a different hand:

vAz (staff): writes almost exclusively English in his own idiolect "lul," "baddy," "=))," signs "-zaza" once, owns the record's only "me0w." Biography incompatible: a minor in 2021 ("when I was 18 then he would [pay]"), raided by police, fled to the UAE, begged the forum for $34k over his father's debts in July 2023 (the operator sent him ~$1,000). Different person (strong).

Support (staff): the forum's actual builder literate, calm Russian, his own distinct typo set, signs «С уважением, Ваш Support». Different person (strong). He matters enormously as a lead see Section 11.3.

chaindel (moderator): a junior RF-based moderator who works at an animal-furniture factory for 20,000 rubles a month, learns JS/React, rambles in comma splices. Different person (confirmed).

Nowheretogo (moderator): the salaried approval clerk $200/month, later $350, paid in BTC Indian-English ("Dobryie Bratan," "Please approve --->>>"), self-described "классик кардер," activity peaking in IST daytime. The operator pays him, scolds him ("Can you please pay more attention to your job?"), and instructs him across two years. An employee, not a sock (confirmed).

☠xrahitel☠: a paid content-writer at $500/month, verbose teacher-style Russian, YouTube embeds, his own forum (the operator once asked him «сколько там всего пользователей… Движок xenforo? Вроде сливали вас» how many users do you have… XenForo engine? I think you got exposed). Different person (strong).

dev_user (staff, registered 2022-03-01, email test@test.tester): zero posts, zero private messages, zero chat not one word in two years of admin activity. A persona that exists only in the infrastructure records: Docker NAT addresses, the management VPS, Tor exits, and one sticky VPN pool. There is no text to fingerprint because it never spoke. It is not a user. It is a pair of hands on the server and Section 9 shows those hands shared the operator's exact infrastructure. (Confirmed: no text exists; infra-only persona.)

The fingerprint matters beyond this file. It is a standing instrument: "бро/ща/хз" register, the typo constellation, the three catchphrases that occur from no one else, the broken-English shelf, the LS-passwords. Any future account, on any forum, can be measured against it.

8. THE CLOCK HE COULD NOT SET

He chose every mask he wore except one. The record holds 1,568 dated events for the admin account across 2021–2024: logins, posts, and 808 hand-typed private messages. Aggregated by hour, the record draws his day.

8.1 The dead zone

All three operator personas admin, Stallman, and the textless dev_user share the same silence:

admin (1,568 events), UTC hour-of-day:

  03Z  38      04Z  30      05Z  32      06Z  35      07Z  33      08Z  32

  ...quietest contiguous 6h: 04:00–10:00 UTC (12.6% of events)...

  13Z 126      14Z 137      15Z 109      <- peak

Stallman (71 events): zero events 04:00–12:00 UTC (one outlier); peak 21Z

dev_user (158 events): quietest 6h 03:00–09:00 UTC (zero events)

Three personas, three independent activity streams, different years one shared dead zone, roughly 03:00/04:00 to 09:00/10:00 UTC. Shared sleep troughs mean a shared clock. And the hand-typed PMs the most human signal in the set, the one no cron job fakes put the trough in the same place as the logins do.

Map the trough to a normal sleep window:

UTC+2 (Kyiv/EET): sleep ≈ 05:00–12:00 local, work peak 15:00–17:00 local.

UTC+3 (Moscow/MSK): sleep ≈ 06:00–13:00 local, work peak 16:00–18:00 local.

UTC+0 (London): fits arithmetically but makes a native Russian speaker a pure night-shift worker in the UK. Less parsimonious.

It does not fit the Americas or East Asia as a home clock that would put his working peak in the middle of his local night and his sleep across the afternoon. Moderate confidence: he lives in the UTC+2 to UTC+3 band, Eastern Europe or European Russia; consistent with UTC+1 to +4. The accounts' set timezones Europe/London and Atlantic/Reykjavik are the kind of choice a privacy-conscious operator makes: technically English-speaking, actually meaningless. Behavior outweighs settings.

8.2 The slips that anchor the math

He confirmed the arithmetic himself, three times, without noticing:

Sent 2023-10-11 01:41 UTC: "could take up to 12 hours, it's a night time here." At UTC+3, he sent that at 04:41 local. Night. ✓

Sent 2023-03-08: "Today is a holiday in russia." March 8 is indeed a Russian public holiday. ✓

And, joking to a partner: "too much going on in Russia, we are prepearing our nuclear ammo all around the country" the "we" doing quiet work. (A joke, flagged as a joke; but men joke from where they stand.)

8.3 The work schedule

The admin account worked the forum seven days a week (Mon 214, Tue 186, Wed 217, Thu 287, Fri 281, Sat 214, Sun 169 events), often in runs spanning twelve or more UTC hours. This was a full-time occupation, not a hobby the forum was his job.

dev_user is the photographic negative: active only 11:00–23:00 UTC, zero Sunday events ever, near-zero Saturday a strict weekday schedule inside the same infrastructure. One reading is a second operator keeping office hours. Another is the same man separating "server work" from "forum work" by day of week. The textless persona gives no vote. (Confirmed pattern; interpretation open.)

8.4 The money clock agrees

Section 10's spend-hour histogram for his master Bitcoin wallet 596 transactions, a completely independent data source concentrates at 01:00–16:00 UTC, peaking 05:00–15:00, near-zero in the evening. Best fit: a UTC+3/UTC+4 workday. Two systems that never spoke to each other a forum's activity record and a blockchain agree on the same clock. (Moderate; behavioral inference, concordant.)

9. THE NETWORK: 958 LOGINS AND ONE MISTAKE

The forum's IP records hold 958 logged events for the admin account, 7 for Stallman, 158 for dev_user. One honesty note before the inventory: the records retain nothing before 2023-02-01 the forum software prunes them so the network picture covers the operator's final year, 2023-02-02 → 2024-02-01; the 2021–2022 era is visible only through post and message timestamps. Within that final year, the operator's human browsing surface resolves to exactly eleven /24 prefixes six commercial VPN providers, one management VPS, server-internal Docker addresses, Tor and one single, solitary exception.

9.1 The management server

68.183.153.132 DigitalOcean, AS14061, geolocating to the NYC metro. This was the forum's management VPS: 314 events for admin over nearly a year (2023-02-02 → 2024-01-25), all 7 of Stallman's events (the account-switch session of Section 1.3), plus dev_user. Alongside it, the Docker NAT addresses 172.22.0.6 / 172.22.0.7 the operator inside his own server, doing administration. The forum's builder, Support, described this stack in his own farewell message: "Вся инфраструктура (контейнеры, сети, система бэкапов) написана мной" all the infrastructure (containers, networks, the backup system) was written by me. The containers are the 172.22.0.x rows. The man who wrote them knew who paid for them. Remember that.

DigitalOcean holds the billing record for that VPS: the payment method, the signup email, the other IPs that ever touched the account. It is a legal-process vector, listed where it belongs, in Section 15.

9.2 The VPN wardrobe

Every human browsing session ran through mass-market VPN exits, rotated by the month:

Prefix Provider PoP Events (admin)

212.102.33.x Datacamp AS60068 / CDN77 New York 155

156.146.36.x Datacamp AS60068 New York 130

195.181.168.x Datacamp AS60068 / CDN77 New York 73

185.102.219.x Datacamp AS60068 / CDN77 Frankfurt 63

159.242.234.x GSL Networks / PRCDN AS137409 "Frankfurt" 107

159.242.227.x (1 login) GSL Networks / PRCDN "London" 1

5.62.41.x / 5.62.43.x Avast SecureLine VPN Frankfurt 76 + 3

The GSL Networks ranges deserve a closer read, because they bind the personas together. GSL's prefixes are labeled, in the provider's own registry objects, "PRCDN Consumer Pool," sold as city-labeled consumer VPN exits the "Algiers" PoP physically resolves to Frankfurt, the "London" PoP is a label, the network is Australian-registered plumbing for retail VPN brands. The point is not geography; the points aren't there. The point is vendor identity:

dev_user the textless infra persona spent nine months (2023-02 → 2023-11) glued to a single GSL pool, 95.142.112.18–31 (47 logins, 24 of them on one address), the "Algiers"-labeled PoP, before drifting into Tor (roughly 70 fresh Cloudflare-adjacent IPv6 Tor exits, 2023-05 → 2024-01).

admin used the same vendor's network from the other side: 159.242.234.x ("Frankfurt") for 107 events, plus one 159.242.227.21 ("London") login on 2023-06-13.

Two admin personas, one white-label VPN vendor, sustained over a year. A subpoena to GSL Networks or to whichever retail brand sold the "Algiers" exit for the 2023 customer records behind that pool, is a concrete, named, subpoena-grade fingerprint. (Strong as infrastructure correlation; yield unknown.)

9.3 The one mistake: Verizon, 2023-03-30

And then there is the row that does not belong.

2023-03-30, 12:14:51 UTC. admin. A cookie_login a returning browser, a remembered session from 166.148.215.206. ARIN says Verizon Business; the ASN is AS6167, Cellco Partnership d/b/a Verizon Wireless; geolocation resolves to Plymouth Meeting, Pennsylvania the Philadelphia metro's mobile switching center. 08:14 on the US East Coast. A phone, or a thing pretending to be one.

It is the only non-VPN, non-server, non-Docker address the admin account ever used in 958 logged events. One connection, one carrier, one morning.

There are exactly two honest readings, and the file keeps both. (1) A US mobile proxy Verizon/AT&T-device proxies are a standard product on the very forums he ran, and he had an observed habit of testing a new proxy source once and moving on. (2) A physical phone on Verizon's network, in the United States, checked into the forum on an idle morning through a browser that had been there before notable against his self-described niche, "US government accesses," and against the recalled boast examined in Section 11: "I travel around Europe, still haven't been caught." (Confirmed: carrier, ASN, timestamp. Speculative: which reading is true.)

What is not speculative is the consequence. A provider request to Verizon for the subscriber and NAT mapping behind 166.148.215.206 at 2023-03-30 12:14:51 UTC is the single most direct network lead that exists. Mobile carrier-grade NAT logs are narrow; the timestamp is to the second; the account is known. If that connection was a phone, Verizon knows whose it was.

9.4 The persona hygiene

The IP records also catch him cleaning house. Stallman never touched the forum from anywhere but the management VPS, and its final session 2023-04-17, the six-minute account-switch of Section 1.3 ends with avatar_delete and account_details_edit, thirty months before the FBI knocked. He was sanding down the public persona's profile years in advance of needing to. Operational security was not a reaction for this man. It was a standing practice.

No residential ISP address exists anywhere in the three accounts' records. Passive IP geolocation is exhausted; what remains is the Verizon timestamp, the VPN vendors' records, and the money.

10. THE MONEY: 55.84 BITCOIN AND A MIXER

The forum ran on Bitcoin, and the operator's escrow and ad businesses left twelve addresses in his own private messages. Every one of them is real, every one is swept empty, and the chain they form is the closest thing to a ledger this case has.

10.1 The wallet inventory

Address Role (per his PMs) Lifetime received Txs First → last activity

1Bc4NkmoQb7a5eA1M2PCChFre8AcETyUBC master wallet 55.84447649 BTC 596 2021-04-05 → 2024-08-23

bc1q6j6g9j24cfkg57hrhz6yev9ym6pleuhtpekkgq escrow, most used 0.39462142 4 2022-01-04 → 2022-01-17

bc1qcvh05dvca25k56k9nclpnq56h9x427fvmcdshy escrow 0.10625000 2 2022-01-07 → 2022-01-09

bc1q9jvaemgc9262g0lzpsx0ke7z0lpj7yvpl6hfmv escrow split 0.06993395 2 2022-01-17 → 2022-01-24

19g7mbR9d6uGUyFPewV1oMz28ciEFdhXQm escrow refund/payout 0.13589597 2 2022-01-17 → 2022-05-26

bc1qk3rh7c0h5pv02rluscjnyrce6kv0n5hv8neaxw ad sales 0.10829661 4 2022-03-31 → 2024-12-23

bc1qxzu4esrm69tucfrpm22nm0s6yt74vysp0qsgzh ad sales 0.02989951 3 2022-09-15 → 2024-12-23

bc1qvt60ku3zumfjljqy3nyxq4xrkncfekze8au3y2 ad sales 0.07700000 2 2022-10-03 → 2022-10-31

bc1qp9c26z9cw3qqfy0fx32kl598dnknx7wf3ck3te ad sales 0.07819580 3 2022-10-24 → 2024-12-23

bc1qlkltuywcqs03wxu46elh6w2d5e0fvsdw4ddcfd $200 verification fee 0.00736240 2 2023-05-23 → 2024-12-23

bc1q0hv5p5gygrqqahj7ds8ssk2kajykjz5rxmspj6 ad sales 0.05769361 2 2023-09-03 → 2024-12-23

bc1q0nrnvcqlty00ymr9c6qxvchdyr0w95px5rhtdk ad sales 0.05760000 2 2023-09-08 → 2024-12-23

Eight more receiving addresses he supplied in ad-sales and escrow threads extend the cluster: bc1quuwkwzrpuwnyzt9tjqpt2u0sunqyxrrrua5x6l, bc1qjvclt6q7d56t4uxhn7u0xhtcp0ef4kjmc4zzjf, bc1qtzejuulhpsjfghz5q2a9h4vptfd4h5n008m5js, bc1qwgswrxaxxkme88zy7ydvpx43pmca6mqy7sh7q7, bc1qa4s3zlrdrjs9a5rjlveswzj0e7c37ptl4aqluf, bc1qfz6jesmux9qps5svlnnk87z86vdnp4l5qqu98s, bc1qllt6vt3zxuclfwng3wfy7grk8kf4rt89cyc5l5, bc1qg6cc8dmcvqqpvjz99hsjyt58rzccvtdn8hevr8.

The structure is a small business's cash drawer. The bc1q addresses are receive-and-sweep fronts escrow deposits, banner-ad payments, the $200 vendor-verification fee each drained to zero. Behind them stands 1Bc4Nkmo…: not an escrow front but the operator's personal master wallet 367 deposits, 596 transactions, 55.84 BTC lifetime throughput, active from 2021-04-05. Read that date. It predates RAMP's public launch by seven months there is a pre-RAMP financial trail on-chain for this man, reaching back into his exploit.in era, when his deposits were already cycling. (He told a partner in November 2021 that on "the neighboring board" he had placed a 1 BTC deposit at exploit.in «На соседнем борде внесен деп 1BTC (exploit.in)».) Cluster lifetime: ≥ 56.8 BTC several million dollars at period prices. CloudSEK's independent analysis of the same cluster (2026) counts $234,102 in traced volume across 1,099 connected addresses and 289 transfers inflows $92,228 against outflows $141,875 first active 2022-01-04, last active 2025-09-02, five months before the seizure.

10.2 The satoshi-exact confessions

The escrow arithmetic in his private messages is reproduced on-chain to the satoshi the strongest possible binding between the man who typed and the wallets that moved:

1. He quoted "0.17 + 5% = 0.1785" (2022-01-03) and "0.20582992 + 5% = 0.216121416 BTC" (2022-01-13), both to bc1q6j6g9j…. On-chain, that address received exactly two deposits, totaling 0.39462142 BTC = 0.1785 + 0.21612142, exactly. The buyer in the same thread a user called Mafia posted the blockchain.com link confirming his payment into the same address. Buyer, operator, and ledger: three witnesses, one number.

2. He posted a "verified transaction" as proof of an escrow payout (2022-01-18): af39d31d25546869e60483c05bdbd1651a1ffbf7c1cbb0ef561f2b88427631e0. On-chain (2022-01-17 22:57:19 UTC), that transaction pays 0.13589597 BTC to 19g7mbR9… his own "escrow refund" address from an intermediate wallet that had itself been funded six minutes earlier by the spend of his main escrow address bc1q6j6g9j…. One actor controlled all three points of that triangle, and that actor is the person who wrote the messages.

3. The front-to-master binding: the 2022-01-07 spend of bc1q6j6g9j… (transaction 5be06da2eebcbe46…) sent 0.06375 BTC directly to 1Bc4Nkmo… the escrow front feeding the 55.84 BTC master wallet in a single hop.

Three more transaction IDs he broadcast himself in escrow threads 5cce66909e94ced123e75a69987ec774d3f2d16a7ccaa9cae574f3b29ca55fb2 (2022-01-13), 90111047f897608fd5af2849a1b8821d6a478a6ff5c1e6cfa0d7c1eae623320d (2022-01-18), 76489e31e0974306386ce6851da5ad7b474c25e2a3e9bd37b00b108d823249e6 (2024-01-11, 0.0247275 BTC) extend the verified set. The escrow was not a forum feature. It was his personal cash register, and the receipts are signed.

10.3 The Binance junction

The single highest-value finding in the financial record. Both sides of his money flow touch Binance's rails within one hop.

Outbound. From 2021-07 through 2023-05, the master wallet made 60+ round-amount payments the classic service-payment pattern, round value plus fresh change address to two addresses: 1PLWrQByLtWwB8wCTQQFayo3w9wJxr541g (~4.94 BTC) and bc1qqpxqeuwjusf7p4yr8s2xala8kchvuel5expsx2 (~3.94 BTC). WalletExplorer clusters both into one wallet a single high-volume service (1PLWrQ alone: 1,988 txs, 76.8 BTC throughput) that received ~8.87 BTC from the operator over two years. That service consolidates its receipts in periodic 100-input sweeps, and every sweep settles directly into bc1qm34lsc65zpw79lxes69zkqmk6ee3ewf0j77s3h an address with 2.29 million transactions and ~59.9 million BTC lifetime, publicly labeled by multiple independent chain-intelligence sources (BitInfoCharts, Dune exchange-reserve dashboards) as the Binance hot wallet. The service the operator paid for two years holds a Binance account whose KYC Binance can produce. (Strong: flows are on-chain fact; the Binance label is third-party but multiply corroborated.)

Inbound. The master wallet's two biggest repeat funders are themselves Binance-fed: 1EUeii6KjMe3jM1rwyzpRbz73Vwb6vj6fw (24 deposits, 4.035 BTC into his wallet) and 1Kd5MEq6B1Huau4CSAfxKJtkSPv8AJgaTs (11 deposits, 2.525 BTC) intermediary wallets directly funded by withdrawals from the Binance hot wallet, plus one single 3.00000000 BTC shot from bc1qmx5js998rg7ykn44k0fntrgfrkjznhhcu95pag. The specific Binance withdrawal transactions feeding these wallets are enumerable; Binance holds the KYC of the withdrawing accounts. (Strong for the Binance link; moderate on whose accounts the customers may be exchangers rather than the operator or his buyers. Correlation, not proof of operator KYC.)

Net: if any of those accounts belongs to the operator himself plausible for a two-year, two-way service relationship Binance's records alone could yield a name. Section 15 returns to this.

A second tier of unlabeled recurring counterparties, each a records target in its own right: 3C8vfNnpgFym8sVT8donX559bpMREsKGuq (~0.46 BTC paid), 1FRPDYWcqf5QmZ4gp34q4BjDjxDFADmUP1 (~0.42), 16CG2n4gxmntVk1XmjF9MGPpMEKNGs3Zjo (~0.70), 354SQeWx4RbE8WMNcmAe3ioehbqeFyaw8j (~0.59), 3FiVe2NHt5UttUbqwGvhqNvaezcQtjvrUb (~1.30 BTC, still active through 2026), and the long-lived funder 36xSUQinibhm6DaHBznwQK51c4n4R62U5F (13 deposits; active since at least 2018 older than RAMP, older than Kajit).

10.4 The margins

The escrow skim sounds lucrative; the business ran thin. CloudSEK's ledger-reading of the same record: the approval-clerk moderator Nowheretogo was salaried at $200 → $350/month in BTC; a banner advertiser paid $1,500 per quarter; Cyclops was quoted $2,000 for a three-month banner; a WWH-Club banner deal died over a $600 gap ($1,600/month asked against a $1,000 budget). Five percent of forum deals, minus salaries, minus servers, minus ads. The motive texture this paints matters for Section 13: when the forum died, a man running those margins had every reason to monetize whatever he still held including, as the rumor had it, the database itself.

10.5 The exit: December 2024 and the January 2025 laundering

The operator's on-chain behavior after February 2024 is a case study in a man who knows he is exposed.

2024-12-23, 17:56–18:45 UTC. All six dormant ad-sale and fee fronts were emptied within 49 minutes to six fresh SegWit addresses a coordinated, single-session wallet migration, and thereby final proof the six fronts were one operator: bc1qvpydg4a59dgduty7sc60eswf2n4m90lfzjgs0h (0.10827890), bc1q3vxqgznjz9klvjejgcaq2sj32dw9u2mlske453 (0.07818298), bc1qdj4snc4n4smsmamklqwrmr604kzu9u6ezdfru3 (0.02988669), bc1q9n8wd67u9splcu2709ayn03mh6eugghnqge3q3 (0.05759230), bc1qeztpjyfx5e9dd52ckn8htnuyrs4586jgxlwqgf (0.00735448), bc1qteqy002veg8ddnw8nq4re0rppgg3q5h7rktypg (0.05768591). (Confirmed on-chain.)

2025-01-02, 15:38–18:20 UTC. All six migration addresses entered four enormous fan-out transactions in the same three-hour window:

2d93259bbd4c065c279c5e8b353f81c554365d27f5111230faa63b87a81cc042   240 in / 301 out   24.08 BTC

b29d70187a0111bc26e99901163ab45cf48e338c8d7a4261bbee5cee86f85385   278 in / 317 out   27.86 BTC

6fbd7de818491461d0bb40015531144cd6dfbcd7852e85d08566bedc7d706a25   294 in / 347 out   36.40 BTC

9bb4cda307022f14e81430f68064b870179c1a8782d4f1c0aad8a26136576e9f   248 in / 274 out   30.25 BTC

~118 BTC churned in three hours. The outputs are hundreds of fresh bc1q/bc1p (Taproot) addresses in structured denominations exact powers of two in satoshis (1.34217728 BTC = 2²⁷ sats; 0.67108864 = 2²⁶; 0.00065536 = 2¹⁶) later re-gathered by 100–200-input batch transactions. Exactly one operator address appears in each fan-out; the other ~775 inputs belong to strangers. The operator pushed his escrow and ad-sale proceeds into a large shared obfuscation service a commercial mixer or high-volume swap on the second day of 2025. (On-chain facts: confirmed. "Mixing service": moderate the split/gather plumbing is unmistakably automated, but the specific service is unidentified. Its internal records are where the trail resumes.)

Note the timeline discipline this proves: the laundering ran eleven months after the last message of his on record. He kept control of the coins, upgraded his address hygiene, abandoned reuse, and washed the proceeds thirteen months before the FBI arrived at his door. He was ready before he needed to be. He always was.

11. THE ECOSYSTEM: TOHA'S CIRCLE

No forum operator works alone at this altitude. Stallman's accession, his infrastructure, his contacts, and his post-RAMP employment all run through one gravitational center: the circle around Toha, the administrator of XSS.is (ex-DaMaGeLaB) the same Toha whose deanonymization Stallman priced at ten bitcoin.

11.1 The brokered coronation, and what it cost

Recall the public record of the transfer (Section 2.3): it was the XSS administrator who advised Kajit to sell RAMP, and "as far as I know, Stallman got it" (Matveev, The Record, 2022-08-25). The successor did not seize the forum or win it in a vote. He was placed vouched for by the one institution whose endorsement mattered, in the same month that institution's rival, LockBit, was destroying the incumbent's name. Whether that placement was mentorship, debt, or under the one-hand reading of Section 4 Toha laundering a burned asset into a fresh mask, the consequence is the same: Stallman's crown came from Toha's circle, and his career stayed inside it.

Then read the ledger again. Two years later, in that private conversation of 2024-01-31, the placed man offered to sell his patron's identity to that patron's most dangerous enemy for 10 BTC. Whatever the relationship was, it was transactional to the marrow.

11.2 thesecure.biz: the cohort marker and the contact web

The Stallman account's registration email stallman2@thesecure.biz is not an email provider in the ordinary sense. thesecure.biz was the criminal-jabber institution of the XSS ecosystem: operated 2010–2014 by Sergeii Vovnenko (Flycracker), who told KrebsOnSecurity (August 2025) first-person that it was "stolen" from him while he was jailed, by Toha and/or N0klos/Sonic; thereafter it was the XSS-admin circle's own jabber and email service used by XSS administrators personally (the DaMaGeLaB-era administrator Ar3s gave out ar3s@thesecure.biz as his own contact in 2018), listed in a Netherlands Police / Dutch Data Center Association notification list (April 2024) as the contact domain of bulletproof-hosting resellers, and the provider Europol says was seized, along with two years of Jabber server logs, when the XSS administrator was arrested in Kyiv on 2025-07-22 (Europol, 2025-07-23; KrebsOnSecurity, August 2025).

The operator held at least two accounts on that service, and his circle held more:

Address Whose Evidence

stallman2@thesecure.biz Stallman the Stallman account's registration email; handed out by both his accounts across 2021–2023

axe1@thesecure.biz the operator's jabber persona (Jan 2022) "My contackts … Jabber axe1@thesecure.biz" (2022-01-19); re-issued by a member in April 2022: "contackts still valid"

qq42@thesecure.biz Support, the infrastructure builder his farewell message, February 2022

stallman@ramp.systems / kajit@ramp.systems the operator's private jabber server handed out 2021-12-11, Section 3.1

His full first-party contact inventory, every item from his own typing:

Jabbers: stallman2@thesecure.biz; axe1@thesecure.biz; stallman@ramp.systems; kajit@ramp.systems. The ramp.systems pair lived on his own server registered at Namecheap in early December 2021 (in his own words: "I need ramp.systems - namecheap account. password wrong"), referred to by his circle as the "letsgobrandon-server" (2022-04-03), and dark to the public web: zero certificates, zero captures, zero indexed pages for its entire operational life. It lapsed and was re-registered at IONOS on 2023-11-15 by an unrelated legitimate company nothing on that domain after that date is his.

TOX IDs: 518887D56EE8CE2B2B2E71393FBFFCAFFC2DB01D751C6F089141DAC256DBAE291E0256B2427C (his most-distributed the same one a member tagged «Ник RED, он же KAJIT»); 2150040EF26F81ED3CFCD9B155077C08A0072B07F3203CA1534077C8D4A1C05A08528E066838 (his "TOX ID 1"); 6DA659269314CF694E33C4680354EA50E87F606ADA19E4D78B669F1912ED6523B791920BFB52 (the Stallman account's own sent in the same conversation where the admin account was handing out stallman@ramp.systems, the two accounts answering the same man back to back).

Cross-forum accounts (self-published for verification): "Stallman" on Exploit («Мой акк на экспе @Stallman») and XSS; the registration-verification accounts he published for moderators: XSS /members/234878/ and exploit /profile/119671-kikersback/.

None of these identifiers has ever surfaced publicly anywhere else not on another forum, not in any public collection, not in any search index. His contact ring existed inside RAMP and inside the jabber servers nowhere else. (Confirmed as absence.)

The consequence lands in Section 15: law enforcement has been holding the thesecure.biz server two years of logs, per the community account Europol's action corroborates since July 2025. That server hosted stallman2@, axe1@, and qq42@. If any machine on earth holds his real jabber counterparties, his login IPs from 2021–2023, and his off-forum negotiation record, it is that one.

11.3 The man who knows who paid the bills

The most valuable human lead in the entire record is not the operator. It is his first administrator.

Support (registered 2021-11-05, four days after launch, staff) wrote to the admin account on 2022-02-05, saying goodbye:

«Привет, я тот, кто создал этот форум. Вся инфраструктура (контейнеры, сети, система бэкапов) написана мной. Настройки самого форума производил тоже я. На данный момент (с ~15 января) я покинул команду рампы… Актуальный jabber: qq42@thesecure.biz»

(Hi, I'm the one who created this forum. All the infrastructure (containers, networks, the backup system) was written by me. I also did the forum's configuration. As of ~January 15 I've left the RAMP team… Current jabber: qq42@thesecure.biz)

«Ранее было настроено резервное копирование на хост 185.7.214.*, но, на сколько мне известно, сервер отключен за неуплату»

(Backup was configured to host 185.7.214.*, but as far as I know the server was switched off for nonpayment.)

He built the Docker containers the operator's own IP records still show. He ran the blog, the Rocket.Chat, the jabber server. He knew the old backup range (185.7.214.0/24, Petersburg Internet Network) and the hardware (a 32 GB RAM / 16-core machine the same machine CloudSEK's account says he briefed Stallman to downgrade when he left, advising him to redesign the theme and clean the Nginx logs regularly). He left on bad terms "отвратительные движения… личное решение" (disgusting moves… a personal decision) three weeks before the public takeover was announced.

He is the one person in the record who knows who paid for the servers he cites nonpayment as the cause of death for the old infrastructure. Whoever paid those bills used a funding instrument, and that instrument had a name on it. (Confirmed: this person, this role, this knowledge exist in the record. Strong as an identification vector a former insider, aggrieved, reachable at qq42@thesecure.biz until the day law enforcement took that server too.)

11.4 The moderator era: «Stallman de facto leads the ransomware community»

The ecosystem's own judgment of where he stood, delivered after Toha's fall. French police and Ukraine's NPU/SBU Operation Ratatouille arrested a 38-year-old man in Kyiv on 2025-07-22 as the alleged administrator of XSS, a forum of 50,000+ users whose operator had earned €7M+ as its trusted middleman (Europol, 2025-07-23; KrebsOnSecurity, August 2025). The XSS that relaunched afterward, XSS.pro, needed staff it could trust. KELA's monitoring (2025-09-04) records what happened next:

On 2025-08-18, the relaunched XSS's administrator appointed Stallman as moderator of the sellers and breaches sections, writing: "Stallman de facto leads the ransomware community."

KELA's profile: active on "various currently existing and previously defunct reputable forums including Exploit, XSS, RAMP (admin), Rutor, and Runion, mainly specializing in breaches and ransomware."

On the splinter forum DamageLib, founded by ex-XSS moderators, he registered on 2025-08-27 as "Stallman2" the same naming convention as stallman2@thesecure.biz said he was staying on XSS.pro only to recover his deposit, and "aggressively" claimed XSS was under police control. (In the XSS deposit crisis roughly 50–55 BTC of user deposits stranded by the arrest he publicly argued that moderators' deposits should be repaid first. The escrow man's priorities, unchanged to the end.)

So in August 2025, the man the FBI would seize half a year later was not hiding. He was moderating the biggest forum in the ecosystem, on two successor boards at once, under his own name, with the public blessing of the new XSS administration. He believed he was untouchable. The next subsection shows why.

11.5 «I know Severa… I travel around Europe»

The closest thing to a self-locational statement on the public record is a recalled quote secondhand, flagged as such preserved in CloudSEK's post-seizure reporting. On XSS, defending Severa a figure the underground widely regards as an FBI cooperator Stallman called him a friend who "helped him earn a lot of money," and wrote, per the recall:

"I know Severa, he knows me, I travel around Europe, still haven't been caught."

(Moderate: secondhand recall quoted by CloudSEK, uncorroborated elsewhere. Identity-relevant if authentic: Europe-traveling, personally acquainted with a known US cooperator, unafraid to say so.)

The underground did not forget the sentence. When the seizure came, it became load-bearing Section 13. Note here only what it adds to the profile: a Russian-speaking operator, on a Moscow-time clock, who says he moves around Europe, whose only non-VPN network touch in two years is a US mobile carrier. Consistent with, not proof of, a man who travels.

12. THE SILENCE: WHAT HE NEVER LET OUT

A deanonymization file is usually built from what a subject spilled. This one is equally a catalogue of what he did not because the absences are disciplined, and discipline is itself identifying.

He never cross-posted his trademark text. His standing access-buy ad («С радостью выкуплю Ваши доступы…») is written in the classic initial-access-broker register the register whose practitioners, like Matveev's BorisElcin, spray their ads across every board in the ecosystem. Stallman's version appears on RAMP and has never surfaced anywhere else. (Strong, as absence.)

He never reused the handle. Every organic "Stallman" in the underground is a Richard Stallman joke; the operator's handle is almost certainly one more free-software irony on a ransomware forum. The handle, its leet variants, its Cyrillic homoglyphs: what surfaces is joke accounts, a Dutch surname, transliterated Russian verbs never him, on any forum, in any era. With two exceptions, both weak:

An account on BreachForums, registered 2023-10-21 under the name stallman, with a Skiff privacy mailbox (stallman@skiff.com), last active 2023-10-24, zero posts, timezone set to −9:30 (Marquesas arbitrary). Skiff was a privacy email provider that shut down in 2024. The handle plus privacy email plus RAMP-era timing is compatible with the operator and equally compatible with a fan grabbing a notorious name. No content survives to test against the fingerprint. Speculative; a watch-item, not an attribution.

A user named exactly Stallman existed on Breached.to in 2022 the forum's own public profile URL for the name survives in search-engine traces but the account itself is gone: deleted or renamed, no posts, no profile data recoverable. Mid/late-2022 registration, RAMP-era timing, nothing else recoverable. Weak trace only.

His Kajit/RED-era identifiers are equally clean. kajit@ramp.systems, stallman@ramp.systems, axe1@thesecure.biz, the three TOX IDs, the domain ramp.systems itself none has ever surfaced publicly anywhere; zero indexed occurrences on the open web. The private jabber server left no certificate, no capture, no page. (Confirmed negatives, as absence.)

What the silence means. Read the absences against the presences. A man operational for four-plus years across Exploit, XSS, RAMP, Rutor, Runion, BreachForums-era venues whose escrow handled other crews' money daily left no publicly recoverable identity string anywhere. Compare his peers: LockBit's TOX was already circulating in a 2022 Breached thread; Matveev's handles smear across a decade of forum history. Stallman's ring is airtight not because he was obscure he was the most visible forum administrator alive but because he practiced, from day one, the discipline he later bragged about: jabber-first contact, TOX rationed to five-deal veterans, «ресечеры заебали». The perimeter held.

That is the discipline this file had to work against, and it is worth stating plainly: his perimeter held against everyone in his own world rivals, researchers, customers, cops. Everything in this file exists anyway. How is not disclosed, and he is in no position to find out.

13. THE SEIZURE AND THE INFORMANT'S WEEK

13.1 The banner

On 2026-01-28, RAMP's Tor site and its clearnet domain ramp4u.io were replaced with an FBI seizure banner (BleepingComputer, The Register, 2026-01-28; The Record, 2026-01-29). The banner carried the seal text "This action has been taken in coordination with the United States Attorney's Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice" and two pieces of mockery aimed point-blank at the operator: RAMP's own slogan, "THE ONLY PLACE RANSOMWARE ALLOWED!," and a winking Masha, from the Russian cartoon Masha and the Bear. DNS moved to ns1.fbi.seized.gov / ns2.fbi.seized.gov, the Bureau's standard seizure nameservers confirming the action after initial community skepticism (the ALPHV fake-seizure of 2024 had burned everyone once). No other agency's logo appeared on the banner unusual for a multinational operation.

And then the strange part: silence. The FBI never issued a statement. It declined BleepingComputer's request for comment. No justice.gov press release, no unsealed indictment, no Rewards for Justice notice naming "Stallman" has appeared confirmed absence, current to this writing. The biggest ransomware-forum takedown since LockBit's was executed and never announced. Whatever the Southern District of Florida is doing with what it took, it is not done. And what it took was everything: the forum, its machine, and whatever four years of an escrow man's business leaves behind on a machine. Every message quoted in this file exists somewhere he can no longer reach and someone else can. He does not get to know whether that sentence is about the seizure or about something older.

13.2 His goodbye

Within days, he surfaced on the rival forums XSS and Exploit (Rapid7, 2026-02-25; SpyCloud, January 2026) and said his piece:

"I regret to inform you that law enforcement has seized control of the Ramp forum. This event has destroyed years of my work building the freest forum in the world, and while I hoped this day would never come, I always knew in my heart it was possible. It's a risk we all take."

"Destroyed years of my work." Four years of two-account discipline, of five-percent escrow, of VPN rotation and jabber rationing ended not by a rival, not by an exit scam, not by his own mistake, but by the state walking in and taking the machine. Then the sentence that defines the aftermath (The Register, The Record, 2026-01-28/29): he would not build a successor forum but "I will continue to buy accesses. My core business remains unchanged." He is not arrested. He is not retired. He is a broker without a board.

13.3 The lie that lasted hours

Days later, he claimed the forum's disks had been encrypted and the circulating leak screenshots were fabrications. CloudSEK's account of what happened next: the claim was "proven false within hours trusted intermediaries cross-verified private messages from RAMP against the seized material, and they matched perfectly." Rapid7 independently noted that former members judged the seized material authentic, and observed that at-rest encryption does not protect a running system anyway. The escrow man who once posted blockchain proofs to the satoshi tried one last bluff against a cryptographic ledger, and the ledger won in an afternoon. (Moderate CloudSEK's reporting; consistent with independent corroboration.)

13.4 The informant's week

Then the ecosystem ate him. CloudSEK and Rapid7 document the turn:

Within hours, users were writing: "He won't return deposits. Information came in that he was an informant. Amen."

The informant theory had two pillars, both pre-fabricated: his public friendship with Severa the recalled quote, "I know Severa, he knows me, I travel around Europe, still haven't been caught" and the seizure's jurisdiction, the Southern District of Florida, "where Severa operates." The man who vouched for a known cooperator was now read as one.

A conversation circulated showing Stallman had been warned, before the seizure, that RAMP's PMs were readable and the infrastructure compromised and had dismissed the warning. His dismissive reply went around as a screenshot. (Moderate CloudSEK; screenshot, not text.)

Within a week, he was banned from every major underground forum. The man who had been made moderator of the relaunched XSS five months earlier "de facto leads the ransomware community" was unpersoned board by board. (Strong CloudSEK.)

By mid-February 2026, reports of house arrests of RAMP users were circulating, with a former staff member warning "The operation is ongoing." No official confirmation exists. (Speculative underground reporting relayed by CloudSEK.)

And the rumor that rhymes: Stallman tried to sell the database for 10 BTC (Rapid7, explicitly "unsubstantiated"). The exact price he once set on Toha's head.

The fragmentation came immediately (confirmed Rapid7, 2026-02-25, with Flare's Tammy Harper to The Register): T1erOne, gated at $450 or reputation, drew Qilin and Cry0; Rehub, open, had LockBit's remnants and Gentlemen already present and added DragonForce the day RAMP fell. The market re-formed in weeks. The man's reputation did not.

Read the whole arc coldly, because it is the ecosystem's verdict, not this file's: he spent four years as the trusted middleman of the ransomware world, and it took that world seven days to decide he was a rat on evidence no stronger than a friendship, a jurisdiction, and a screenshot. The same trust mechanics he administered for a living, turned on him at full speed. Whether he was an informant, a scapegoat, or merely the last man holding the bag, the record does not say, and this file will not pretend it does. What it does say: the informant narrative is the second time a persona adjacent to this operator died of exactly that accusation. Kajit was destroyed by it in January 2022. Stallman was destroyed by it in February 2026. If Section 4's one-hand reading is right, the same man has now been burned as an informant twice, under two names, by the same crowd and survived both.

13b. THE CORROBORATING CAST

The record is not one man talking to himself. Around the operator stands a circle of people who independently anchor pieces of the story, each a separate thread:

Mikhail Matveev (Orange/Wazawaka/BorisElcin). RAMP's creator publicly identified, DOJ-indicted 2023, reported arrested in Kaliningrad in November 2024. His first-person interview (The Record, 2022-08-25) is the public origin of the ownership chain: he gave the forum to Kajit, and "as far as I know, Stallman got it."

Toha, the XSS administrator. The broker of Stallman's accession (per Matveev and cybercrimediaries); the operator of thesecure.biz, where Stallman kept his jabbers; the man whose deanonymization Stallman priced at 10 BTC. Arrested in Kyiv on 2025-07-22 (Europol), his jabber server seized with him.

LockBit (LockBitSupp). The accuser who destroyed the Kajit persona in 2021–2022, and the buyer in the 10-BTC conversation of 2024-02-01. His last RAMP login is minutes before the admin's final offer; Operation Cronos took his operation eighteen days later. The US named him Dmitry Khoroshev in May 2024.

Support (qq42@thesecure.biz). The man who built the forum containers, networks, backups, jabber and left three weeks before the takeover was announced, on bad terms, knowing who paid the bills.

vAz. The young staffer who asked the admin account, point-blank and in private, "kajit, its u??" fifteen months after the supposed handover.

chaindel. The junior moderator who addresses the same account as "Каджит" and "Стэлман" in a single message, and preserves the payroll detail: "мне Каджит заплатил 400 дол."

Nowheretogo. The salaried approval clerk $200, then $350 a month in BTC whose two years of being paid, scolded, and instructed by the operator prove the payroll was real and the boss was one man.

Анальгин. The member who wrote the alias chain into the record in one sentence: «Ник RED, он же KAJIT», addressed to the admin account's own TOX.

pabloescobar and Palooza. Members who greet the root account as "Kajit" (2021-12-30) and congratulate him on "your new forum" while speaking of Kajit in the third person (2022-02-04) the transition as the floor saw it.

honey / "Khajit." The previous era's partner, whose account resurfaced in 2023 to ask what had happened to him: "He disappeared about 5 August." Unanswered, publicly, to this day.

Mafia. The escrow buyer whose posted blockchain link confirms his payment into the operator's escrow address to the satoshi a stranger's receipt for the operator's till.

Severa. The alleged FBI cooperator Stallman called a friend "I know Severa, he knows me, I travel around Europe, still haven't been caught." The friendship became the post-seizure informant theory's first pillar.

Every one of these people is an independent thread. None of them needed to exist for the operator's own messages to be true. That is the difference between a rumor and a record.

14. WHAT HE IS

Everything below is strong-confidence or better, assembled from the preceding sections. This is the profile as it stands, without a name.

He is one operator, not a team. Two forum accounts demonstrably switched on one keyboard (Section 1.3); a textless infrastructure persona sharing his VPS, his VPN vendor, and his sleep window (Sections 7.5, 8.1, 9.2); salaried employees beneath him, not partners beside him (Nowheretogo at $200–350/month, xrahitel at $500, chaindel at $400 one-off). The "RAMP administration" was a man with clerks.

He is Russian-native, UTC+2/+3, full-time. Native-speaker fluency with a schoolmaster's reflex toward other people's Russian; a sleep trough at 03:00–10:00 UTC shared by all three of his personas and corroborated independently by his Bitcoin wallet's spend cadence; "it's a night time here" at 04:41 MSK; "Today is a holiday in russia" on March 8. He claims to travel around Europe. His only non-VPN network touch is a US mobile carrier. (Each element labeled in Sections 8, 9, 11.5.)

He is an initial-access broker first and a forum administrator second. His own sentence dates from the forum's third week: «моя ниша это гос. доступы США. У меня свой приватный криптолокер.» He bought 10–20 accesses a day; he claims his own private locker, his own stealer with delayed C2, his own deployment crew; Babuk-era locking experience surrounds his early circle. The forum was the storefront. The accesses were the business the business he publicly promised to continue the day the storefront burned.

He is an escrow professional, trusted at the top of the market. Five percent of every deal, satoshi-exact on-chain; vouched into ownership by Toha's circle; trusted by LockBit with its XSS-ban dispute; appointed moderator of the relaunched XSS with the words "de facto leads the ransomware community." His professional brand was reliability «Жаба у меня онлайн всегда, ничего не теряется обычно» (my jabber is always online, nothing usually gets lost) and it held for four years.

He is disciplined beyond his cohort's norm. No identity string of his has ever surfaced publicly anywhere; a private jabber server invisible to the public web; contact rationing as written policy; persona hygiene performed years in advance; coins held for a year past exposure and laundered through power-of-two-structured mixing. His perimeter was never breached from outside his own world.

And he is transactional to the bone. He offered a patron's identity to that patron's enemy for 10 BTC in the same paragraph where he offered friendship "as families"; he argued moderators' deposits should be repaid before users'; his signature price ten bitcoin attaches to heads and databases alike. Loyalty, in his record, is a position, not a principle.

If the moderate-confidence finding of Section 4 holds, then he is also this: one man who built RAMP as Kajit, burned, rebranded as his own buyer, and ran it four more years as Stallman a three-mask operator whose "predecessor" was himself. If it does not hold, he is the man who arrived with Kajit's server, Kajit's vocabulary, Kajit's escrow, and Kajit's staff's suspicions, within days of Kajit's fall. The difference between those two sentences is a name only law enforcement can now supply.

15. WHAT WOULD NAME HIM

No legal name for Stallman is publicly recoverable not from any public record, not from any outlet, researcher, court, or agency, current to this writing. The record assembled here ends one step short of a passport, and it is worth saying exactly where that step lies. The vectors below are concrete, named, and most of them already in friendly hands.

1. The seized server itself. The FBI took RAMP's machine and whatever four years on it left behind and the cross-verification that destroyed his "encrypted disks" claim showed the contents were readable. The party best positioned to name Stallman today is the one that took his forum and never announced it.

2. Binance. Section 10.3: the service he paid ~8.87 BTC across two years consolidates directly into the Binance hot wallet; his two biggest repeat funders are Binance-withdrawal-fed. The KYC behind (i) the service wallet's consolidation account and (ii) the withdrawal accounts feeding 1EUeii6… and 1Kd5MEq… in 2021–2024 is enumerable and subpoena-able. One hop from his money, in both directions.

3. Verizon. Section 9.3: 166.148.215.206, AS6167, 2023-03-30 12:14:51 UTC, a cookie_login on a known account. Carrier NAT logs plus the exact timestamp are the narrowest possible request. If that connection was a phone, it had an owner.

4. GSL Networks / the retail VPN brand. Section 9.2: dev_user's nine-month adhesion to 95.142.112.18–31 (the "Algiers" PoP) and admin's 159.242.234.x ("Frankfurt") are one vendor's customer records away from a billing identity and a client-IP log. 2023, one pool, one account.

5. DigitalOcean. Section 9.1: 68.183.153.132 was the management VPS for a full year. The billing record payment instrument, signup email, account-level access IPs names its tenant.

6. Namecheap. Section 11.2: ramp.systems was registered there in early December 2021, by the operator's own account ("I need ramp.systems - namecheap account. password wrong"). Registrar records for the original registration window are a direct line to the payment and identity layer of his private jabber infrastructure.

7. The seized thesecure.biz jabber server. Europol, 2025-07-23: taken with the XSS forum, with per the community account two years of Jabber logs. It hosted stallman2@, axe1@, and qq42@. Registration data, login IPs, roster relationships, and the off-forum negotiation record of the entire circle are on it. Law enforcement has held it since July 2025.

8. The mixing service of 2025-01-02. Section 10.5: four fan-out transactions, ~118 BTC, structured denominations. On-chain tracing stops at its door; its internal records resume the trail.

9. The humans. Support (qq42@thesecure.biz) knows who paid the server bills. The jabber-spam vendor he paid to blast exploit.im and thesecure.biz user bases ("i am working on jabber mailing on expoit.im and thesecure.biz"; "I have ordered jabber ads on exploit and xss jabbers on 8th of march") knows his paying wallet and jabber. The partner who shared honey's account knows what happened to Khajit on 2023-08-05. Toha's circle whoever advised the sale knows who they sold RAMP to.

Every vector on this list is a records request, not a research project. The architecture of his exposure is complete; it only lacks the signatures on the subpoenas and, for at least items 1 and 7, the signatures already exist. And one honest caveat, for the reader and for him: this list is what can be seen from outside. It does not include what cannot.

16. TIMELINE

Date Event

2010–2014 thesecure.biz operated by Sergeii Vovnenko (Flycracker); later passes to the XSS-admin circle (per Vovnenko, to KrebsOnSecurity, Aug 2025)

2021-04-05 Master wallet 1Bc4Nkmo… first on-chain activity pre-RAMP financial trail begins

2021-07 Matveev (Orange) builds RAMP on Babuk's old Tor infrastructure; Orange admin, MRT/999/KAJIT moderators (McAfee ATR/Intel 471, 2021-09-09)

2021-10-18 Kajit named RAMP admin (Velasco/Group-IB via The Register, 2021-12-02); admin account registered 14:45:28 UTC same day

2021-11-01 RAMP opens to the public; Stallman account registered 23:33:54 UTC, email stallman2@thesecure.biz

2021-11-10 The standing access-buy ad: «С радостью выкуплю Ваши доступы»

2021-11-22 «моя ниша это гос. доступы США. У меня свой приватный криптолокер.»; first "KJ" sign-off

2021-11-25 Guarantor-Service announced, "represented by me personally"

2021-12-06 "I need ramp.systems - namecheap account. password wrong"

2021-12-10 Second "KJ" sign-off: "We need to prepare some surprise to feds"; «Сети ставлю от 100кк+» deployment claims

2021-12-11 stallman@ramp.systems and kajit@ramp.systems handed out; the Stallman account's TOX sent in the same conversation

2021-11 → 2022-01 LockBit accuses Kajit of FSB/police ties, REvil-panel hack, BlackMatter screenshot exposure via vx-underground chats (KELA ~2022-03; Analyst1 2022-01-27; secrss 2022-01-21)

2022-01-04 Escrow wallet cluster first on-chain activity operational takeover underway

2022-01-15 Support (the infrastructure builder) leaves the team

2022-01 (late) Kajit banned from XSS and Exploit; Toha advises selling RAMP to Stallman; "Stallman" publicly defends Kajit on XSS (cybercrimediaries, 2024-02-08)

2022-02-02/03/10 The takeover announcements, four versions

2022-03-01 dev_user registered the textless infrastructure persona

2022-07-01 «Теперь Я владелец и админ этого форума… Stallman»

2022-08-16 «Ник RED, он же KAJIT» member identifies the admin's TOX

2022-08-25 Matveev interview (The Record): "as far as I know, Stallman got it"

2023-04-17 The six-minute account switch; the Stallman persona's avatar deleted; persona retired

2023-04-22 vAz to the admin account: "kajit, its u??"

2023-08-05 honey/Khajit disappears; never publicly explained

2023-10-21 BreachForums stallman / stallman@skiff.com account registered (speculative)

2024-01-31 → 02-01 The XSS ban mediation and the 10-BTC deanon offer to LockBit; LockBit's last RAMP activity 02-01 02:36 UTC

2024-02-19 Operation Cronos seizes LockBit infrastructure

2024-08-23 Master wallet's last activity

2024-12-23 All six ad-sale/fee fronts swept in 49 minutes

2025-01-02 ~118 BTC pushed through mixing infrastructure in 3 hours

2025-07-22 XSS administrator arrested in Kyiv (Operation Ratatouille, Europol); thesecure.biz jabber server seized with two years of logs

2025-08-18 Stallman appointed moderator of relaunched XSS.pro: "Stallman de facto leads the ransomware community" (KELA, 2025-09-04)

2025-08-27 Registers "Stallman2" on DamageLib; claims XSS is under police control

2025-09-02 Wallet cluster's last traced activity (CloudSEK)

2026-01-28 FBI seizes RAMP (S.D. Fla. / CCIPS); no official statement ever issued

2026-01/02 His goodbye: "destroyed years of my work… I will continue to buy accesses. My core business remains unchanged."

2026-02 "Encrypted disks" claim disproven within hours; informant accusations; banned from every major forum within a week; house-arrest reports circulate; T1erOne and Rehub absorb the market

16b. THE EVIDENCE INDEX

Every material claim, with its anchor:

# Claim Anchor

1 admin == Stallman, one operator Own declaration (2022-07-01); six-minute account switch on one VPS (2023-04-17, Section 1.3)

2 Founding accounts predate/lead the public forum admin registered 2021-10-18; Stallman registered launch day 2021-11-01

3 Kajit named admin on the same day the admin account was born Velasco/Group-IB via The Register, 2021-12-02, vs. registration timestamp 2021-10-18 14:45 UTC

4 The Kajit persona and its fall KELA "Beware. Ransomware." 2021 (~2022-03); Analyst1 (2022-01-27); secrss (2022-01-21); own.security (2024-01-11)

5 "RED" == KAJIT «Ник RED, он же KAJIT» (2022-08-16); Analyst1 "RED \ KAJIT"; Khodjibaev-relayed chat log

6 The transfer to Stallman was Toha-brokered Matveev interview (The Record, 2022-08-25); cybercrimediaries Ch. III (2024-02-08)

7 The successor's name predates the succession stallman@ramp.systems handed out by the Kajit-era account (2021-12-11); Stallman account registered 2021-11-01

8 The operator ran his own jabber server "I need ramp.systems - namecheap account"; "its my new private jabber"; "letsgobrandon-server" (2022-04-03)

9 Kajit == Stallman (moderate confidence) Sections 3–4: pre-provisioned identity, shared idioms found from no one else, shared mistake dialect, "kajit, its u??" (2023-04-22)

10 The niche: US gov accesses + private cryptolocker «моя ниша это гос. доступы США. У меня свой приватный криптолокер.» (2021-11-22)

11 Industrial-scale access buying "10-20 access per day now" (2023); standing buy-ad (2021-11-10)

12 Ransomware deployment claims «Сети ставлю от 100кк+» (2021-12-10); "3 peoples in it" crew (2021-11-20); delayed-C2 stealer

13 Escrow run personally at 5% Guarantor announcement (2021-11-25); escrow arithmetic (2022-01-03, 2022-01-13); satoshi-exact on-chain matches (Section 10.2)

14 The 10-BTC deanon offer Private conversation of 2024-01-31 → 2024-02-01 (Section 6)

15 LockBit's feud corroborated independently Trend Micro / govinfosecurity (Feb 2024); KELA (2025-09-04)

16 The linguistic fingerprint Typo constellation; "спаммеры заебали" / "Thank you for your service" / «Поймал» occur from no one but his two accounts (Section 7)

17 LS-prefixed password habit Five generated passwords, verbatim (Section 7.4)

18 Staff are different people; dev_user is textless Section 7.5: vAz, Support, chaindel, Nowheretogo, xrahitel excluded; dev_user zero texts in 2 years

19 Shared sleep window, UTC+2/+3 03/04–10 UTC dead zone across three personas (Section 8); "it's a night time here" (2023-10-11); March 8 (2023-03-08)

20 Management VPS 68.183.153.132, DigitalOcean, 314 admin events (Section 9.1)

21 VPN wardrobe; GSL binding across personas Datacamp/CDN77, Avast, GSL/PRCDN pools; dev_user's 9-month 95.142.112.x adhesion (Section 9.2)

22 The one non-proxy connection 166.148.215.206, Verizon AS6167, 2023-03-30 12:14:51 UTC (Section 9.3)

23 Persona hygiene avatar_delete + details edit, Stallman's final session (2023-04-17)

24 Master wallet 1Bc4Nkmo…, 55.84 BTC, 596 txs, 2021-04-05 → 2024-08-23 (Section 10.1)

25 Escrow-to-master binding 0.06375 BTC, bc1q6j6g9j… → 1Bc4Nkmo… (2022-01-07)

26 Binance junction, both directions ~8.87 BTC to a service settling in the Binance hot wallet; funders Binance-withdrawal-fed (Section 10.3)

27 CloudSEK cluster economics $234,102 traced, 1,099 addresses, first active 2022-01-04, last 2025-09-02 (CloudSEK, 2026)

28 The 2024-12 migration and 2025-01 laundering Six fronts swept in 49 minutes; ~118 BTC through power-of-two-structured fan-outs (Section 10.5)

29 thesecure.biz cohort marker and seizure Vovnenko to Krebs (Aug 2025); Europol (2025-07-23): server seized with two years of logs

30 The operator's contact web stallman2@/axe1@/qq42@/stallman@/kajit@ jabbers; three TOX IDs; none ever surfaced outside RAMP (Sections 11.2, 12)

31 Support knows who paid «я тот, кто создал этот форум…» (2022-02-05)

32 Moderator of the relaunched XSS "Stallman de facto leads the ransomware community" (KELA, 2025-09-04); DamageLib "Stallman2" (2025-08-27)

33 Europe-travel self-claim "I know Severa, he knows me, I travel around Europe, still haven't been caught" (recalled; moderate)

34 The seizure FBI banner, S.D. Fla. / CCIPS, ns1.fbi.seized.gov (BleepingComputer / The Register / The Record, 2026-01-28/29); never officially announced

35 His goodbye and his lie "destroyed years of my work… My core business remains unchanged"; "encrypted disks" disproven within hours (CloudSEK; Rapid7, 2026-02-25)

36 The informant's week Banned from every major forum; house-arrest reports; the 10-BTC database-sale rumor (CloudSEK; Rapid7 labeled)

37 The silence No identity string ever surfaced publicly; zero web-indexed occurrences of any contact of his (Section 12)

38 stallman@skiff.com (speculative) BreachForums account, registered 2023-10-21, zero posts watch-item, not attribution

39 honey/Khajit's disappearance "He disappeared about 5 August" [2023] (CloudSEK's account; moderate)

40 No legal name publicly recoverable Absence confirmed across press, researchers, courts, RFJ current to this writing (Section 15)

18. A NOTE ON METHOD

What is quoted. Every quoted line attributed to the subject is a dated message he typed himself a forum post or a private message presented verbatim, as a reader would see it with the message open in front of them. Russian quotes carry an italic English translation beneath; the Russian is the source of record. No database identifiers are cited; dates and context stand in their place, and nothing factual is withheld.

What is inferred. The Kajit–Stallman single-operator finding is labeled moderate confidence and presented beside the two-person reading in full (Section 4). The timezone, the Verizon connection's meaning, the Europe-travel claim, and every secondhand quote carry their confidence labels where they appear. On-chain claims are stated as on-chain facts; attributions built on them are labeled.

What is public. Public reporting is cited by outlet and date The Record, The Register, BleepingComputer, KELA, CloudSEK, Rapid7, Analyst1, KrebsOnSecurity, Europol, and others. The blockchain records are public. The network intelligence providers, ASNs, geolocations is public. Where public reporting and the rest of the record disagree, the file says so.

What is not disclosed. How the materials quoted here came into the author's hands is not disclosed, and will not be. Sources are protected by silence, not by description: this file neither claims nor denies any specific origin, and the reader any reader is left with the evidence, not the channel.