A multidimensional cybercrime annotation dataset for a closed-access Russian–English underground hacking forum

Abstract

This dataset provides a multidimensional cybercrime annotation layer for XIN, a closed-access Russian–English underground hacking forum comprising approximately 1.3 million post annotations across roughly 200,000 threads and 52 sub-forums, posted between February 2005 and August 2025. Every post is annotated along four dimensions drawn from established underground-forum coding schemes: post type (the communicative function of the post), author intent (the stance or social purpose), crime type (the category of cybercrime discussed), and supply-chain category (the role of the traded product or service). Labels were assigned through a codebook-based prompting procedure that applied a predefined scheme of category definitions, decision rules, and anonymized examples. We release the codebooks and the per-dimension label distributions over the full corpus. The annotations enable supervised and zero- or few-shot classification, benchmarking of automated labeling against a documented scheme, cyber threat intelligence extraction, and cross-lingual analysis of a community that is underrepresented in public corpora.