Report Traces the Evolution of the English-Speaking Cybercrime Ecosystem
Summary
The report charts how English-speaking cybercriminal communities evolved into a decentralized, service-based ecosystem, linking social engineering, account takeovers, data theft, and extortion, and recommends stronger identity verification and phishing-resistant MFA.
Key points
- The report traces the ecosystem’s evolution from username-trading forums such as OGUsers to a broader criminal marketplace supporting breaches, SIM swapping, extortion, and fraud.
- It describes how social engineering, including vishing and manipulation of help-desk staff, combines with credential theft and access brokerage to compromise organizations.
- Lapsus$, ShinyHunters, and Scattered Spider are presented as examples of groups shaped by overlapping communities and shared criminal services.
- Forum seizures and arrests disrupted centralized hubs, but activity shifted toward Telegram, Discord, invite-only channels, and other fragmented platforms.
- The report describes Scattered Lapsus$ Hunters as a 2025 coalition and summarizes its claimed attacks and reported use of social engineering, data exfiltration, and public extortion.
- The ecosystem’s modular supply chain—such as callers, phishing-kit developers, initial access brokers, and data extortionists—makes reliance on static indicators less effective.
- Recommendations include phishing-resistant MFA, stricter identity checks for account recovery, and stronger protections and monitoring for help-desk and privileged staff.
Article Details
- Publisher
- CloudSek
- Scope
- Historical evolution, social-engineering operations, underground service supply chains, and disruption of the English-speaking COM cybercriminal ecosystem through 2025.
- Key Statistics
- The report states that platforms disrupted during 2021–2023 collectively hosted over 500,000 active users; this is not a count of confirmed attackers.
- BreachForums reportedly grew from 1,500 to over 192,000 users within eight months after its launch.
- Scattered Lapsus$ Hunters allegedly affected over 700 organizations and purportedly exfiltrated 1.5 billion records through attacks involving Salesforce environments; these figures are claims, not confirmed incident totals.
- The report states that the 2014 Christmas attacks affected approximately 110 million PlayStation Network subscribers and 48 million Xbox Live users.
- Lizard Stresser offered monthly packages priced from $19.99 to $200, with attack durations of 20 to 60 minutes.
- Recommendations
- Require strict identity verification for password resets and MFA changes, and conduct targeted phishing and vishing simulations for support personnel.
- Move sensitive accounts away from SMS-based authentication toward phishing-resistant MFA, and educate users about SIM-swapping risks.
- Apply time-bound, audited, multi-approval access controls to internal administrative tools and monitor their usage for anomalies.
- Develop response playbooks for public leaks and adversary taunting that coordinate SOC, PR, and legal teams.
- Diversify threat-intelligence collection across Telegram, Discord, and private communities, tracking high-reputation actors across platforms.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | exploit[.]in | Cybercriminal marketplace where the report describes initial-access brokers, SIM-swapping specialists, and vishing crews offering services. |
| DOMAIN | raid[.]lol | RaidForums backup domain linked by device forensics to its operator; the forum facilitated stolen-data and credential sales. |
| DOMAIN | rf[.]ws | RaidForums backup domain linked by device forensics to its operator; the forum facilitated stolen-data and credential sales. |
MITRE ATT&CK
T1078 · Valid AccountsActors obtain privileged accounts, VPN credentials, and cloud administrator sessions and use identity-based access to enter enterprise environments.T1111 · Multi-Factor Authentication InterceptionSIM swapping intercepts OTPs and 2FA tokens, while phishing kits capture MFA responses in real time.T1219 · Remote Access ToolsSilent Ransom Group uses legitimate remote tools for access; Scattered Lapsus$ Hunters persuades employees to install remote tools.T1486 · Data Encrypted for ImpactRansomware-as-a-Service affiliates deploy ransomware after obtaining access from initial-access brokers.T1498 · Network Denial of ServiceLizardSquad conducted network denial-of-service attacks, and its commercial service offered DNS/NTP amplification.T1539 · Steal Web Session CookieThe report describes phishing kits incorporating session-cookie stealers to bypass authentication.T1566.002 · Spearphishing LinkSMS phishing campaigns direct recipients to attacker-controlled phishing sites.T1566.004 · Spearphishing VoiceCallers use voice phishing and helpdesk impersonation to obtain credentials, reset passwords, and persuade employees to grant access.
People
Arion KurtajNamed Lapsus$ participant linked to breaches of technology companies and the Rockstar Games footage leak; identified as White, Breachbase, WhiteDoxbin, and TeaPotUberHacker.Bradley Jan Willem van RooyNamed LizardSquad member who managed its Twitter accounts and launched DDoS attacks; identified as UchihaLS and Dragon.Conor Brian FitzpatrickNamed BreachForums founder, identified as Pompompurin and associated by the report with the 2021 FBI email hack.Diogo Santos CoelhoNamed RaidForums founder, identified as Omnipotent, who operated a fee-based middleman service for data and credential sales.John SmedleyDaybreak Game Company CEO against whom the report says LizardSquad retaliated by attacking company servers.Jordan Lee-BevanNamed individual arrested in connection with the Christmas attacks; the report does not provide a conviction.Julius KivimäkiNamed LizardSquad member, identified as Zeekill/Ryan; the report describes computer-crime convictions and the Vastaamo breach.Kim DotcomReportedly negotiated an end to the Christmas DDoS attacks by offering premium MegaPrivacy vouchers.Vinnie OmariNamed LizardSquad spokesperson arrested for alleged PayPal fraud; the report says he was later cleared of involvement in the Christmas attacks.Zachary BuchtaNamed co-founder of LizardSquad and PoodleCorp who operated harassment services, trafficked stolen card information, and pleaded guilty to conspiracy.
Threat Actors
@fbiarelosersExplicitly identified as an alias of Zachary Buchta.AnastasiaNamed administrator of the stolen-data trading forum BreachForums during its later instability.Arion KurtajNamed individual linked to Lapsus$ breaches; explicitly identified as White, Breachbase, WhiteDoxbin, and TeaPotUberHacker.BaphometNamed administrator of the stolen-data trading forum BreachForums following Fitzpatrick's arrest.Bradley Jan Willem van RooyNamed LizardSquad member associated with DDoS attacks and cyberattack-for-hire websites; aliases include UchihaLS and Dragon.BreachbaseExplicitly identified as an alias of Arion Kurtaj.Chatty SpiderName associated by the source with UNC3753 and the Silent Ransomware Group data-extortion cluster.Cl0pGroup to which the report links Ransomware-as-a-Service affiliates.Coinbase CartelDescribed as an emerging data-extortion group whose leak site invites insider partnerships.Conor Brian FitzpatrickNamed BreachForums founder associated with the FBI email hack; explicitly identified as Pompompurin.ContiGroup whose splinter cells are linked by the report to ransomware affiliates.Diogo Santos CoelhoNamed operator of RaidForums and its fee-based stolen-data middleman service; explicitly identified as Omnipotent.DragonExplicitly identified as an alias of Bradley Jan Willem van Rooy.HOICSquadDescribed as a contemporary of Lizard Squad participating in public attack claims and victim taunting.IntelBrokerNamed underground actor described as administering BreachForums on behalf of ShinyHunters.Julius KivimäkiNamed LizardSquad member linked to computer crimes and the Vastaamo breach; identified as Zeekill and Ryan.LAPSUS$Group associated with social engineering, SIM swapping, insider recruitment, corporate breaches, public leaks, and extortion.LeakedDataName associated by the source with UNC3753 and the Silent Ransomware Group data-extortion cluster.lizardExplicitly identified as an alias of Zachary Buchta.Lizard SquadCollective responsible for high-profile gaming-network DDoS attacks and a DDoS-for-hire service; also written as LizardSquad in the report.LockBitGroup to which the report links Ransomware-as-a-Service affiliates.Luna MothName associated by the source with UNC3753 and the Silent Ransomware Group data-extortion cluster.OmnipotentExplicitly identified as the pseudonym of Diogo Santos Coelho.peinExplicitly identified as an alias of Zachary Buchta.PompompurinExplicitly identified as the alias of Conor Brian Fitzpatrick.PoodleCorpSuccessor group co-founded by Zachary Buchta and associated with continued cyberattack-for-hire operations.RyanExplicitly identified as an alias of Julius Kivimäki.Scattered LAPSUS$ HuntersReported coalition of Scattered Spider, Lapsus$, and ShinyHunters formed in mid-2025; its claimed breaches and exfiltration totals are not independently confirmed in the article.Scattered SpiderGroup explicitly mapped to UNC3944, associated with enterprise social engineering and SIM swapping.ShinyHuntersData-breach and extortion group explicitly mapped to UNC5537; described as contributing to Scattered Lapsus$ Hunters.Silent Ransom GroupData-extortion group discussed in the report; the source also uses Silent Ransomware Group and associates it with SRG and UNC3753.Silent Ransomware GroupSource naming variant associated with UNC3753, SRG, Luna Moth, Chatty Spider, and LeakedData; uses callback phishing, vishing, and remote tools.SRGAbbreviation associated by the source with Silent Ransom Group and UNC3753.TeaPotUberHackerExplicitly identified as an alias of Arion Kurtaj.UchihaLSExplicitly identified as an alias of Bradley Jan Willem van Rooy.UNC3753Cluster associated with SRG, Silent Ransomware Group, Luna Moth, Chatty Spider, and LeakedData; targets U.S. law firms for data extortion.UNC5537Explicitly mapped to ShinyHunters and described as conducting credential theft, database breaches, and data extortion.UNC6040Cluster described as specializing in outsourced vishing and labeled Callers For Hire.UNC6240Described as a possible evolution or splinter of UNC5537 linked to cloud-centric attacks; that relationship is uncertain.UNC6395Actors believed to operate alongside the broader LAPSUS$-aligned network using rented infrastructure and short-term phishing crews.WhiteExplicitly identified as an alias of Arion Kurtaj.WhiteDoxbinExplicitly identified as an alias of Arion Kurtaj.Zachary BuchtaNamed LizardSquad and PoodleCorp co-founder associated with harassment services and stolen-card trafficking; aliases include @fbiarelosers, pein, and lizard.ZeekillExplicitly identified as an alias of Julius Kivimäki.
Products
Amazon Fire Stickin September 2022, when Kurtaj, under police protection at a Travelodge hotel, used a hotel TV, Amazon Fire Stick, and a mobile phone to infiltrate Rockstar Games and leak footage of the unreleased Grand Theft AutoBreachForumsLaw enforcement takedowns of major forums (RaidForums, BreachForums) cause fragmentation but not collapse, pushing activity onto Telegram, Discord, and invite-only channels.BreachStarsBreachStars (The Premier Hub)Dark0deHistory of “THE COM“ : Early Forum Ecosystem ( Dark0de, RaidForums , OGUsers )DarkForums DarkForums (The Entry-Level Alternative)DiscordLaw enforcement takedowns of major forums (RaidForums, BreachForums) cause fragmentation but not collapse, pushing activity onto Telegram, Discord, and invite-only channels.Instagramusernames known as “OG” (original gangster) handles on platforms like Twitter, Tiktok, Telegram and Instagram. These short, brandable usernames carried significant value, sometimes selling for thousands of dollars.OGUsersreputation among threat actors. These early spaces provided fertile ground for the rise of forums like OGUsers, which further amplified social engineering tactics and account takeovers. Following a wave of lawPlayStation Networkattacks against gaming networks and major corporations. The group gained infamy for disrupting PlayStation Network and Xbox Live on Christmas Day 2014, affecting millions of gamers worldwide. Following extensiveRaidForumsThe COM's foundations were laid in early forums like RaidForums, which cultivated a strong sense of community and reputation among threat actors. These early spaces provided fertile ground for the rise of forums likeSalesforceThe Salesforce Ecosystem Breach: They accessed sensitive data using integrated third-party apps (e.g. DataloaderSalesloftDrift) to infiltrate Salesforce environments, allegedly affecting 700+ organizations andTelegramLaw enforcement takedowns of major forums (RaidForums, BreachForums) cause fragmentation but not collapse, pushing activity onto Telegram, Discord, and invite-only channels.TikToksought-after social media usernames known as “OG” (original gangster) handles on platforms like Twitter, Tiktok, Telegram and Instagram. These short, brandable usernames carried significant value, sometimes sellingTwitterDissect landmark incidents Twitter hacks, MGM/Change Healthcare attacks, multi-million dollar crypto heists forensically, with detailed attention to attacker tools, techniques, and procedures (TTPs)Xbox Livegaming networks and major corporations. The group gained infamy for disrupting PlayStation Network and Xbox Live on Christmas Day 2014, affecting millions of gamers worldwide. Following extensive law enforcement
Tools
Countries
Brazilinternational collective than a traditional cybercrime syndicate. Co-conspirators were arrested in Brazil, the UK, and the US, revealing a wide operational footprint. In Brazil, Operation Dark Cloud exposedFinlandcollective operated as a loose network of primarily teenage hackers from various countries, including Finland, the UK, the Netherlands, and the United States.Netherlandsas a loose network of primarily teenage hackers from various countries, including Finland, the UK, the Netherlands, and the United States.North KoreaDecember 22, 2014: LizardSquad claimed responsibility for taking North Korea's entire internet infrastructure offline through a massive DDoS attack, affecting the country's approximately 1,000+ IP addresses.Portugal25, 2022. Operation Tourniquet involved the FBI, NCA, Europol, and law enforcement agencies from Portugal, Romania, and Sweden.Romania2022. Operation Tourniquet involved the FBI, NCA, Europol, and law enforcement agencies from Portugal, Romania, and Sweden.SwedenTourniquet involved the FBI, NCA, Europol, and law enforcement agencies from Portugal, Romania, and Sweden.United Kingdomoperated as a loose network of primarily teenage hackers from various countries, including Finland, the UK, the Netherlands, and the United States.United Statesprimarily teenage hackers from various countries, including Finland, the UK, the Netherlands, and the United States.
Industries
Critical infrastructureforms of financial fraud frequently targeting multinational corporations, government entities, critical infrastructure, and retail investors alike.Cryptocurrencyincluding large-scale data breaches, extortion campaigns, SIM-swapping attacks, ransomware incidents, cryptocurrency draining, rug pulls, and other forms of financial fraud frequently targeting multinationalGaminga collective that operated between 2014 and 2016. Their chaotic, high-visibility DDoS campaigns against gaming networks, combined with their pioneering of the "DDoS-for-hire" model, served as a direct precursor toGovernmentrug pulls, and other forms of financial fraud frequently targeting multinational corporations, government entities, critical infrastructure, and retail investors alike.Law firmsand legitimate remote tools to gain access and exfiltrate sensitive files. Focused heavily on U.S. law firms.SaaSfocus on OG username trading. Their targets rapidly expanded to include large consumer platforms, SaaS providers, and enterprise environments.TelecommunicationsUsing scripted pretexts and psychological manipulation, callers deceived telecom and platform support staff to execute SIM swaps and account takeovers.