StealthMole traces NamasteLSD's original darknet operation to its 2021 store seizure and finds later sites reused its branding. A lookalike altered payment details, consistent with phishing; no post-seizure site was verified with the original PGP key.
StealthMole used indexed Telegram records to trace YY520CN’s underground activity, advertised services, financial records and response after CrowdStrike reporting. It documents associations and claims but says key operations and attribution remain unverified.
StealthMole linked RockHavks to earlier underground-forum seller accounts through a persistent Session ID, reused listings and a shared typo. Telegram records trace one account’s changing identities, but RockHavks attribution and advertised dataset claims remain unsubst
StealthMole traced Uways Qarani’s six-week activity across forums, a website and Telegram, identifying shared infrastructure and a consistent posting sequence. Its attack claims and asserted Ansar Allah affiliation remain unverified.
StealthMole says it linked ImLupin’s UK credential-dump listings to a rebranded Telegram storefront, two account shops and a historical Telegram ID. Evidence suggests an Indonesian connection, but the seller’s real-world identity remains unresolved.
An investigation links TeamPCP, CipherForce and PCPcat through historical infrastructure, recurring account identifiers and cross-platform posts. It cautions that some correlations and claims remain unresolved and do not establish real-world identities.
A StealthMole investigation traced Al-Shabaab-related media from Telegram posts to Shahada News accounts and contacts across platforms. It identifies distribution links but says evidence does not establish that every user or channel is affiliated with Al-Shabaab.
StealthMole traces The Night Hunters’ fragmented Telegram and social-media network, linking it to seven defacement alerts and actor-published claims of database, government and industrial-control access. The claims are not independently verified.
