StealthMole Traces YY520CN’s Underground Activity and Response to Exposure
Summary
StealthMole used indexed Telegram records to trace YY520CN’s underground activity, advertised services, financial records and response after CrowdStrike reporting. It documents associations and claims but says key operations and attribution remain unverified.
Key points
- StealthMole pivoted from @YY520CN to Telegram user ID 6634116390, finding more than 2,000 indexed messages; the associated phone number did not establish the account operator’s real-world identity.
- Records place the account in Dog Shield from December 2023 and on administrator and supervisor lists in 2024; they document community roles, not independent confirmation of technical capability.
- Posts advertised DDoS services, Cloudflare origin tracing, account-banning and personal-information lookup services, with DogPay escrow. The advertisements do not verify successful operations.
- Telegram records include a repeatedly shared TRON address, wallet alerts and DogPay balance snapshots, but do not establish wallet ownership or a complete flow of funds.
- In 2025–26, YY520CN advertised infrastructure and claimed commissioned intrusions, a gambling-platform intrusion and data sales; the article says these claims could not be independently verified.
- After CrowdStrike-linked reporting circulated in October 2026, YY520CN denied wrongdoing and said police had not contacted him. The account later appeared without a username or display name.
- The investigation does not establish that YY520CN was responsible for all activity in CrowdStrike’s research; a possible link to @JJCDN remains unconfirmed.
Article Details
- Attack Vectors
- YY520CN advertised DDoS and attack services. A forwarded stress-test result identified the account as the tester and reported 667.17k requests over 180 seconds; the article does not independently verify who initiated the test.
- YY520CN advertised tracing the origin IP of websites, including sites protected by Cloudflare, and said the discovered origin could then be attacked directly.
- CrowdStrike linked YY520CN to activity targeting South Korea’s financial sector. The article says its own findings do not independently confirm responsibility for all activity in CrowdStrike’s research.
- YY520CN described commissioned intrusions and an alleged intrusion into a gambling platform, and advertised data he claimed came from intrusions. These claims are not independently verified in the article.
- YY520CN advertised personal-information lookup services targeting Chinese individuals, but the article does not verify the source or accuracy of the information.
MITRE ATT&CK
T1498 · Network Denial of ServiceA stress-test result forwarded by YY520CN identified him as the tester and reported 667.17k requests over 180 seconds; he later claimed a DDoS attack stopped betting bots.T1590.005 · IP AddressesYY520CN advertised tracing the origin IP addresses of websites, including sites protected by Cloudflare, before attacking the discovered origin.