Intelligence X

Virgil Griffith court documents archive: https://intelx.io/?did=a7020388-1ec9-4c3a-9148-bf0609da1d5b Case: United States v. Virgil Griffith (1:20-cr-00015) Related articles: https://www.justice.gov/usao-sdny/pr/united-states-citizen-pleads-guilty-conspiring-assist-north-korea-evading-sanctions https://www.coindesk.com/policy/2021/09/27/ethereum-developer-virgil-griffith-pleads-guilty-to-conspiracy-charge-in-north-korea-sanctions-case/

Here are the Conti ransomware manuals archived. Use the Tree View tab to navigate between files. https://intelx.io/?s=77252046-5045-4a3d-ba6a-a1d8aee4c4e8 For details see this article: https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals/

One user scraped 88,172 pastes from our API and uploaded it. That's about 0.001% of pastes in our index. The dump only includes pastes <= 2021-05. We were able to find the account (and other related accounts) that were involved in the scraping. During this research we found that this user was targeting the CEO of a datacenter/uplink provider we work with. The actor registered multiple accounts under "http://my.sunywcc.edu" email addresses. He abused our Academia program which provides free access to certain categories including Pastes. Some of the accounts were registered in 2020 and we were able to seize them. After publishing the details and freezing the account, the actor continues to register accounts (with edu emails). In a tweet today he posted his redacted account details. As per our privacy policy (which the user agreed to), we share information about attackers with the public.

The US State Departments has a Secure Drop on Tor at he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion. Looking through mentions on https://intelx.io/?s=he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion 🔒 it shows a mention on the hacking forum XSS, another on DarkMarket (screenshots). This tweet https://twitter.com/SttyK/status/1420648957881978886 mentions that it uses the "Endgame" anti DDoS solution.

UK Guntrader website was hacked: https://www.fieldsportschannel.tv/guntrader-co-uk-hacked-not-much-lost/ Indexed here (use Tree View to navigate): https://intelx.io/?did=e8c512ca-2c9c-4495-bf3c-8ecff1ac677d

It looks like NSO Group had this paste removed (titled "NSO Employees 2017"). Here is the copy in our archive: https://intelx.io/?s=5406a1b3-bc40-4eab-bc78-03afe62c5aeb 🔒

In other news, the new Usenet category is live and stores 209,469,453 selectors. It is expected grow substantially in the near future.

⚠️ Saturday 03.07.2021 starting at 06:00 UTC we are moving to a new state of the art datacenter. During the move http://intelx.io, http://phonebook.cz, and APIs will be temporarily unavailable. We will post status updates on our Twitter account https://twitter.com/_IntelligenceX. The move is expected to be finished in the late afternoon on the same day.

Authorities seize SlilPP, a marketplace for stolen login credentials https://therecord.media/authorities-seize-slilpp-a-marketplace-for-stolen-login-credentials/ Some historical info via various SlilPP domains (earliest mentions are from 2017): https://intelx.io/?s=slilppnyhik6febe.onion https://intelx.io/?s=slilpp.xyz https://intelx.io/?s=slilpp.ws