Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Baptiste Robert Profile picture
@fs0c131y
Aug 23, 2024 • 27 tweets • 16 min read • Read on X
Scrolly
Today, the famous hacker USDoD has been doxed by CrowdStrike.

You want to know how?

It's #OSINT time!
First the recap. This morning @TecmundoDigita published an article based on a report from CrowdStrike received from an anonymous source.

"The likely leader of the USDoD group is a 33-year-old man named Luan BG who lives in Minas Gerais, Brazil"

tecmundo.com.br/seguranca/2885…
@TecmundoDigita The article is full of info, more or less partial, without any sources. We don't have access to the initial report. I don't like that. So, at @PredictaLabOff we decided to find the truth by ourselves

Thanks to and the job is done! predictasearch.com
beta.predictagraph.com
Image
@TecmundoDigita @PredictaLabOff Let's go for the full deep dive.

Before his suspension last month, USDoD used the Twitter account @equationcorp. The bio of the account was "I protect the hive. When the system is out of balance, I correct it" Image
@TecmundoDigita @PredictaLabOff @EquationCorp zerodaycorp on Instagram, previously barbosa.luan_, has the same phrase on his profile.

This is a small link, maybe a coincidence, but it's worth digging
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp This instagram account has been mentioned by a tattoo artist. Not my style but why not?

instagram.com/wilkertattoo93…
@TecmundoDigita @PredictaLabOff @EquationCorp This Instagram account has been mentioned in this SoundCloud profile:

Luan describes himself as "Goa Trance producer from Brazil and CEO and Founder of LBGRecords."

It gives us also an old Twitter account and a Facebook account soundcloud.com/lbg91



Image
Image
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Thanks to Tineye, with a reverse image search, I was able to find the Medium account of Luan: natsec.medium.com

Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp One of his article, mentioned an AlienVault pulse. Same name as the Insta account. See the medium link? His old Medium username was luanbgs22

Image
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Thanks to the awesome WhatsMyName, from luanbgs22 we can find a Gravatar account. Same face, this is our guy.

Do you know? You can get an email from a Gravatar profile. Thanks to hashtray for example, we found the email luanbgs22@gmail.com

Image
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Now the fun is coming!

Thanks to , we found a lot of info linked to this email: Github, Gravatar, TV Time, leaked data and registered domains by this email predictasearch.com

Image
Image
In the RaidForums data breach, a hacking forum, we can see that this email is linked to the username LLTV

Moreover, the email has been used to register , , .

On Reddit the user LLTV talked about BlackSUSE: blacksuse.org
blacksuse.wiki
blacksuse.systems
reddit.com/r/linux/commen…Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp The Reddit user LLTV mentioned also the Medium blog NatSec:

We are still on the right tracks! But more fun is coming reddit.com/r/cybersecurit…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Remember with we found his Github account:

The bio is "Linux User/Gray Hat/Pet's lover/Future Ruby Programmer/Os-Dev." and by looking at his repo Luan like reverse engineering. predictasearch.com
github.com/Labs22

Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Luan worked hard on BlackSUSE a Linux distribution based on OpenSUSE.

By searching BlackSUSE on search engines we found this post about BlackSUSE from the user ElmagoLoko on the forum Hack Forums hackforums.net/showthread.php…


Image
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp On another post on the same forum, ElmagoLoko posted a link to his Github profile which is... the one we found earlier.

Luan is Elmagoko, he loves reverse engineering and pentesting.

github.com/Labs22
hackforums.net/showthread.php…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp A good #OSINT thread always needs a dating profile mention.

ElmagoLoko has a profile on the dating website Friend Finder. The age is consistent with the rest

friendfinder-x.com/profile/Elmago…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp This is the last sprint.

On Hack Forums (again), ElmagoLoko, published a Jabber email: ElMagoLoko@hacker.im

hackforums.net/showthread.php…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp This email is mentioned on Guiado Hacker, a hacking forum (again), by an user called CryptoSystem.

forum.guiadohacker.com.br/vb5/forum/segu…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp CryptoSystem was active on Guiado Hacker in 2020 - 2021 and posted multiple data leaks: BlackWater, Chinese Communist Party, Cayman National Bank

Very similar to what USDoD was doing ;)

forum.guiadohacker.com.br/vb5/member/942…



Image
Image
Image
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Let's take the hack of the Cayman National Bank.

It has been done by the famous hacktivist Phineas Fisher:

The leak has been published by the Distributed Denial of Secrets group and well it's still available today

en.wikipedia.org/wiki/Phineas_F…
caymannewsservice.com/2019/11/hackti…
@TecmundoDigita @PredictaLabOff @EquationCorp Time to sumup:

1. USDoD has the same bio than the Instagram account of Luan Gonçalves Barbosa
2. He is a music producer based in Brasil
3. Based on his digital footprint he loves hacking and reverse engineering
4. He has accounts on multiple hacking forums and posted data leaks
@TecmundoDigita @PredictaLabOff @EquationCorp Is Luan USDoD?

Yep he confirmed it to a statement to HackRead 2 hours ago

hackread.com/usdod-hacker-s…
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Good luck to all the people involved to this case.

All this investigation, tweets included, has been done in 10 hours by the 2 best #OSINT analysts at @PredictaLabOff and myself. Also, without and it wouldn't be possible. beta.predictagraph.com
predictasearch.com
Image
@TecmundoDigita @PredictaLabOff @EquationCorp Thanks for reading and don't forget #OPSEC is hard!
@TecmundoDigita @PredictaLabOff @EquationCorp Bro come on… Someone try to login to my unused Patreon account Image
@TecmundoDigita @PredictaLabOff @EquationCorp Update: USDoD say goodbye to his friends on TG

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Baptiste Robert

Baptiste Robert Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @fs0c131y

Baptiste Robert Profile picture
Mar 15
Regarding the DDoS attack on X:

- Yes, we have identified the correct individual, and he is aware of it. He has attempted to delete evidence since the publication of the tweet.
- Again, it’s not a one-man job. We have also identified the other members of the team.
- They are aware of it. They sent 500 million requests to predictasearch.com over the last three days.
- Trust the process. A report has been sent to the concerned authorities, and they will do their excellent work as usual.Image
They created a new Telegram channel. The last post they forwarded is from a channel called "Russian Partisan." This is not surprising according to our initial findings.

Image
Image
Regarding the DDoS attacks on :

Cloudflare is clearly the best option available on the market when it comes to DDoS attack protection. predictasearch.comImage
Read 5 tweets
Baptiste Robert Profile picture
Mar 11
Hi @elonmusk,

I've identified the people responsible for the DDoS attack on X yesterday. I'm currently in Washington and will be at the Eisenhower Building tomorrow (for another matter). Would you be interested in meeting?

In the meantime, let me explain

It's OSINT time! Image
@elonmusk Yesterday, a group called "Dark Storm Team" claimed responsibility for a DDoS attack on Twitter.

Their leader, MRHELL112 on Telegram, has previously used usernames like Darkcrr, GLITCHAT1, and GLITCHcracker. Image
Image
Image
@elonmusk In a Telegram channel about "DDoS Attack Services," DrSinaway is mentioned alongside Darkcrr.

DrSinaway’s TG bio also references a group called CyberSorcerers. Image
Image
Image
Read 11 tweets
Baptiste Robert Profile picture
Mar 3
Votre volonté d’ajouter une porte dérobée dans les applications de messagerie est une énorme idiotie. Presque autant que votre condescendance…

Explications ⬇️
Beaucoup s’inquiètent, donc madame explique. À coup de novlangue et de mots clefs.

Le fameux : “Si les français ne comprennent pas c’est que l’on n’a pas assez expliqué”

Vous prenez les gens pour des idiots et après la classe politique s’étonne des résultats dans les urnes
Après avoir dit que le texte est trop large un tweet plus haut on parle “des services” ? Il n’y avait pas un mot plus large dans le dictionnaire de la French Tech ?

Non il n’y a pas de backdoor qui respecte les libertés et la vie privée. C’est un MENSONGE.
Read 12 tweets
Baptiste Robert Profile picture
Feb 7
Operation TALENT - Tracking the Hackers

On January 29th, Operation Talent dismantled the cybercrime forums Cracked and Nulled, led by two young individuals and used by millions.

Want to dive deeper?

It's OSINT time! ⬇️Image
To complete this investigation, the @PredictaLabOff team utilized our platforms predictagraph.com and predictasearch.com.

Thanks to the collaborative mode, you can access a snapshot of the graph here:
predictagraph.com/graph/snapshot… Image
@PredictaLabOff Time to uncover who was behind the forum Cracked.

@CrackedTo is the official X account of the forum. The associated email, olivia.messla@outlook.de, was revealed in the 2023 Twitter breach. Image
Read 16 tweets
Baptiste Robert Profile picture
Jan 19
The IP address of DrugHub, a well-known dark web drug marketplace, has been exposed.

The website owner made a critical OPSEC blunder.

It's OPSEC time!
On the website's /info/market-links page, three links are provided:
- The primary .onion address
- A clearnet link
- A permanent mirror Image
Currently, drughub[.]xx is protected by Cloudflare, but two months ago, it was hosted on the IP address 186.2.171.6. Image
Image
Read 9 tweets
Baptiste Robert Profile picture
Jan 14
Worried about a TikTok ban? Americans are now flocking to Xiaohongshu (REDnote), another Chinese app.

Spoiler: Yes, it tracks its users.

Time to dive in! ⬇️ Image
When creating an account, you must verify your phone number by entering a code received via SMS.

The request sent to Xiaohongshu's server includes your phone number (of course), along with your IDFA and IDFV. Image
Image
What’s an IDFA? The Identifier for Advertisers (IDFA) is a unique device ID assigned by Apple to every iOS device.

Many actors, like data brokers, use it to profile you, track your location, and more.

Read 13 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(