Rehub and the stolen-data shops: how the market for logs outlives its takedowns
On August 10, 2025, a Russian-language platform called Rehub opened for business, launched by a former moderator of XSS, weeks earlier one of the underground's central forums until law enforcement took it down. According to Flashpoint researchers, Rehub embraced what its rival DamageLib, started by other XSS moderators on August 1, deliberately abandoned: illicit commerce. Its Supermarket section advertises ransomware affiliate programs, compromised network access, malware, stolen financial data and leaked databases, and the site runs on both the clearnet and Tor. Rehub is the newest face of an older trade - the market in stolen logins, cookies, fingerprints and access - that has been shut down and reassembled in public view for years.
What a line of inventory actually is
The core commodity is the stealer log: the automated haul of data taken from a single infected machine. Kaspersky's researchers, who monitor the darknet venues selling these files, define them as automated collections of data stolen by stealer malware. As catalogued by Sekoia's threat research team, a typical log bundles system details and browser data - saved URLs and credentials, cookies, autofill entries, stored card data - plus material from desktop applications such as mail clients, messengers, cryptocurrency wallets and VPN tools. Sekoia put pricing for qualified, exclusive stock between $5 and $100 depending on data volume, the victim's country and accuracy; storefronts let buyers filter by domain, hunting for corporate VPN portals, admin accounts and security tooling. The premium tier is not the password but the session. Cookies and browser fingerprint data let a buyer resume an authenticated login and make it look like the victim's own browser. That packaging was Genesis Market's core product: each identity sold as a bot, complete with a custom browser for replaying it. Passwords can be reset; sessions and fingerprints transfer. April 2023: the inflection that moved the market
On April 5, 2023, an operation spanning 17 countries took Genesis Market offline, with 119 arrests, 208 property searches and 97 knock-and-talk measures against its users, according to Europol; the marketplace had listed the identities of over two million people when it was shut down. The action removed the trade's most polished storefront. It did not remove the commodity. Sekoia's researchers, writing within weeks of the seizure, described the standing trade on centralized shops such as Russian Market and 2easy and suggested the takedown would accelerate decentralized sales - subscription communities and Telegram bots. Clouds, bots and resellers: the syndication layer
That layer was already documented. Sekoia described 'clouds of logs', private communities selling subscription access to bulk inventory for $200 to $900 per month; one alleged operator, BSC, advertised 10,000 fresh logs a day at $2,299 per month, with more than 300,000 logs held as of December 2022, a quarter of them from European victims. Telegram bots served as on-demand storefronts: a search for a single airline in one bot returned 500 matching logs. Between the malware operators and the shops sit processing tools such as BLTools and Crystal, which normalize, deduplicate and validate lines, sometimes checking account balances before sale. Researchers flagged the layer's structural flaw: buyers resell, so inventory leaks between venues - a syndication effect in which the same lines surface on multiple storefronts. The takedown itself fed circulation. Trend Micro reported in November 2023 on operations that mirrored Genesis techniques, including a malicious browser extension of the kind Genesis had sold, and noted reports that Genesis's infrastructure and inventory had been sold on the underground after the seizure. Whether a genuine revival existed remained unconfirmed; that the methods persisted did not. Rehub and the forum consolidation
The sequencing since then follows the pattern Flashpoint has traced for the forum tier. XSS was taken down on July 23, 2025, and its displaced users faced a choice of successors; Rehub openly kept the commerce. When the ransomware-focused forum RAMP was seized on January 28, 2026, they migrated again. By July 2026, Flashpoint counted over 8,300 active users and 15,000 posts, with ransomware brands including DragonForce - assessed as the forum's likely sponsor or partner - running affiliate programs in the open. Membership tiers run from $100 to $5,000 per year, disputes pass through an arbitration section with a public scammer list, and since mid-April 2026 new accounts are confined to a sandbox until vetted. What enforcement changed, and what it did not
Read as a sequence - Genesis in 2023, the stealer and loader disruptions of 2025, XSS and RAMP into 2026 - enforcement has consistently shifted the trade rather than ended it. Each action removes named infrastructure, exposes some participants and raises operating costs; each also displaces inventory and buyers toward the next format. The centralized shop gave way to the subscription cloud, the cloud to bot storefronts, and the forum supermarket now aggregates affiliate programs, databases and access sales behind a sponsor banner. We described the current storefront layer and the limits of the 2025 stealer disruption wave in our earlier piece on stealer-log markets after the takedowns. For anyone watching the category, the signals worth tracking are structural: whether commerce keeps consolidating into forums with sponsor financing, how quickly pricing for qualified logs moves, and whether escrow by arbitration holds. The names change on a schedule. The supply chain, one infected browser at a time, does not.
