Might be my best sleuthing scoop this year (ah still 30+ days to go!):

Venya

Really nice work!

But...

"However, it is likely that Kiberphant0m’s facility with computers and networking was noticed by the Army, which undoubtedly would have placed them in some kind of role involving both."

That's, um, REALLY not how talent management in the Army works.

David

@briankrebs An interesting application of machine learning may be camouflage recognition—analogous to fingerprint or face recognition. The exact alignment of a pattern to fabric pattern pieces per article of clothing or luggage is presumably unique.

It should be possible to exactly match the pants and/or backpack to those issued to exactly one US soldier, as shown in social media or publicity photos.

BrianKrebs

@venya Thank you! That's comforting.

S. G. Tallentyre (🤨 ┻━┻)

@briankrebs

Buttholio. That's a name.

S. G. Tallentyre (🤨 ┻━┻)

@briankrebs

Also, you did an outstanding job piecing all of this together, and this just goes to show how it's always OPSEC failures that get come back to bite you if anything's going to. He used the same usernames in multiple places each, and would get on one of his accounts and name at least one of the others. Correct me if I'm wrong, but it looked like he used the same string of apparently random numbers in two places, for some reason. I've sent people links to my account here, from other accounts elsewhere that I don't necessarily want associated with this one, and I really thought about it beforehand like, "I'm sure if someone were smart enough and they had enough time on their hands, they could probably dig this up and associate both accounts years later." I'm sure they could, too, but they're not gonna get anything juicy because of that. This dude was using the same Discord account to talk about Escape from Tarkov, tell people he's in the Army, talk about South Korea, and tell people about his hacks. That's asinine.

Andrew 🌻 Brandt 🐇

@MagentaRocks @briankrebs maybe they're behind 7 proxies!

BrianKrebs

@StephenTallentyre This guy was undone primarily by two things that often trips up people like this: They can't stand it when someone belittles what they do, and often feel the need to prove themselves. Also, they screw someone over -- often over something really insignificant - and they end up getting doxed over it. In this case, Kiberphant0m ripped a member of the Russian forum Exploit over $350, and the admin listed all other accounts associated with the same cookie. That right there was a rosetta stone.

BrianKrebs

@threatresearch @MagentaRocks No, I think this guy's layers go to 11

S. G. Tallentyre (🤨 ┻━┻)

@briankrebs

Wow.

Catherine is disorganized

@briankrebs I hear the USDB in Leavenworth makes boot camp look like a five star resort.

Kynx

@briankrebs awesome investigative journalism! I note the mind maps - not my thing (it’s pen-and-paper when I need to think) but it made me wonder: are there other tools you use when linking connections in large datasets?

BrianKrebs

@Kynx a large text-only file