The internet holds vast secrets for those who know how to look
Joined June 2025
- Tweets1.5K
- Following60
- Followers6.2K
- Likes16K
Pinned Tweet
How Threat Actors Abuse Legal Processes 🔥
A deep dive look at fraudulent subpoenas, warrants, EDR and the shinyhunters domain seizure
intelops.st/how-threat-actor…
IntelOps retweeted
If you want the full context on why we turned down the takedown request, we wrote it all up here: blog.flokinet.is/2026/10/29/…
US Department of Homeland Security (DHS) has asked Icelandic web host FlokiNET to take down a site with data on tens of thousands of employees, including ICE personnel. FlokiNET refused, citing a "legitimate" public interest. aje.news/b21ca4
IntelOps retweeted
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: nitter.cf/zachxbt/status/2104528…
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
IntelOps retweeted
Code-execution flaw in UEFI firmware affects most servers on planet Earth: arstechnica.com/security/202…
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
IntelOps retweeted
the WhiteArmor ransomware group has listed crypto swap platform Wagyu with a demand of $5,000,000
"We hold 38,628 orders and 10,139 IPs from Wagyu (@PerpetualCow): wallets, sessions, fingerprints, countries, $907M XMR-heavy volume."
IntelOps retweeted
ADVANCED OSINT WITH BELGIUM’S FCCU 🇧🇪
We spent three days with Belgium's Federal Computer Crime Unit analysts covering advanced attribution, verification and OpSec.
Thanks to our trainer @OSINT_Tactical and @policefederale FCCU analysts.
IntelOps retweeted
the Patched hacking forum has been offline for an entire month. They have finally released a statement as to why.
"On September 23, a Russian drone strike on telecommunications facilities in Ukraine damaged the data center hosting our servers. We later learned that the data center holding our backups had also been damaged. Our servers and backups were with two separate hosting providers, but the attack did not affect just one provider; several hosting companies in the region were impacted.
We kept backups in three places: two separate physical devices and one cloud storage service. According to our providers, the drives are in good condition and are waiting in the queue to be copied. Thousands of drives are being recovered, which is why the process has taken so long."
