Thread by @fs0c131y

Ivan Gennadievich Kondratyev, a.k.a. “Bassterlord” has been added to OFAC's SDN list

It gives us an email address. It's time for an investigation. THREAD ⬇️ ofac.treasury.gov/recent-actions…

Who is Bassterlord ?

According to Jon Di Maggio from @Analyst1:
- Bassterlord is a ransomware affiliate who runs his team, known as the National Hazard Agency. Originally, he was a junior. team member, but as time progressed, he moved up the ranks and is now its leader.

- Bassterlord partnered with at least four ransomware gangs: REvil, RansomEXX, Avadon and LockBit.

- Bassterlord is a Caucasian male around 27 years old, born, raised, and living in Lugansk, Ukraine. He operates on Russian underground forums under the monikers “Fisheye,” “Bassterlord,” “Buster,” and “National Hazard Agency,” which is also the name of his team.

analyst1.com/ransomware-dia…

@Analyst1 First things first, I searched the email [e-mail] on . It gives us a lot of online profiles. predictasearch.com

@Analyst1 In the data breaches tab of the report, we can see that his email was in a Twitter leak. It gives us his Twitter handle @It9111 predictasearch.com

@Analyst1 @It9111 A phone number linked to this email can be found in another leak. Time to pivot.

https://x.com/MackjackMaier/status/1760302900478161098?s=20

@Analyst1 @It9111 The email is also in the 000webhost leak (2015) and it gives the following location (48.511,38.6722) in Bryanka, Luhansk Oblast, Ukraine

@Analyst1 @It9111 In the report, we can also see the phone hint of the Apple account linked to this email. It's probably the same phone mentioned before (both ends with 38) predictasearch.com

https://x.com/MackjackMaier/status/1760302900478161098?s=20

@Analyst1 @It9111 Also, he has a profile linked to this email

It gives a date of birth, location and one of his previous school. ok.ru
ok.ru/profile/594933…

@Analyst1 @It9111 A user with the same name than the profile (Koyerd Uhvwi) leaves a review about a dental clinic in Новомосковск ok.ru
novomoskovsk.fooby.ru/company/stomat…

@Analyst1 @It9111 The profile states that he lives in Алексинский район. The dental clinic address is Россия, Тульская область, Новомосковск, Комсомольская улица, 36/14, 1 этаж.

This is pretty close ok.ru

@Analyst1 @It9111 In multiple leaks his personal address is available: Россия, Тульская обл, Новомосковский р-н, г Новомосковск, 301664, Маяковского ул, д. 10/2, кв. 59

And yes, it's a 12 min walk to go the dental clinic

https://x.com/fs0c131y/status/1760310137036669276?s=20

@Analyst1 @It9111 This is why I love #OSINT. Look that, this is cool af.

In multiple online profiles our guy used the name "Koyerd Uhvwi". If you search this name, you find this Youtube channel : youtube.com/@koyerduhvwi37…

@Analyst1 @It9111 If you go to the playlist tab, you will find an unlisted video. Look who has a nice new Lockbit tatoo!

@Analyst1 @It9111 It's not finished. I have a lot of photos. Trying to confirm before publication

He had a lot of info on his (now deleted) VK profile. The names and dob are identical to what we found in the leaks previously

He had a good time during the summer in 2016

Our guy was looking for love. Face, name, age and region are consistent with what we found before за30.рф/page/89977ttxw…

With the help of the @PredictaLabOff relational graph, we mapped (almost) all the info found in this thread

@PredictaLabOff I will end the thread here. It was a fun ride. END