January 19, 2026 By Tushar Subhra Dutta
The cybercrime world operates in shadows, but when insiders turn against each other, those shadows shrink.
In February 2025, an individual using the alias ExploitWhispers surfaced on Telegram and released internal communications from the BlackBasta ransomware group.
The leak contained a JSON file with roughly 200,000 messages spanning over a year, from September 2023 to September 2024.
Among the exposed details were real identities, including Kirill Zatolokin, better known in underground forums as Slim Shady. This revelation marked the beginning of a chain reaction that would unravel an entire criminal infrastructure network.
The first leak was followed by another in March 2025, when an unknown actor released a database connected to Media Land, a Russian business that appeared legitimate on the surface.
The database revealed server configurations, client purchase records, user account information, and cryptocurrency wallet addresses.