Threat Actor Summary

Introduction

“Chucky” is a cybercriminal actor associated with the administration and operation of the cybercrime forum LeakBase, a platform dedicated to the distribution and sale of stolen databases and compromised credentials. The actor is believed to have become active around 2021, however, earlier indicators of online activity date to 2013 (Flare, 2023).

Researchers published a detailed attribution analysis, assessing with high confidence that Chucky, the alias “beakdaz”, and the LeakBase administrator are all the same individual — an actor linked to Taganrog, Russia, with cybercrime activity dating back to 2009 (KELA, 2026).

It is speculated that Chucky operates from Russia. This assessment is based on researchers identifying a Skype account believed to be associated with the actor (Virus Bulletin, 2023).

LeakBase operated primarily as an English language forum that facilitated the exchange of compromised data between cybercriminal actors. The platform allowed users to share and sell breached datasets, including personal information, authentication credentials, and stealer logs collected from infected systems. By 2025, LeakBase reportedly had approximately 142,000 registered users, highlighting its scale within the cybercrime ecosystem (Cybernews, 2025).

“Chucky” has been associated with several aliases across cybercrime forums, including “Chuckies” and “Sqlrip”, suggesting attempts to maintain a presence across multiple platforms and identities (Flare, 2023). In addition to the forum itself, Chucky reportedly maintained associated Telegram channels used to distribute data leaks and communicate with members of the cybercrime community (Virus Bulletin, 2023).

Notable breaches published by Chucky include DELL and Tappware.

In March 2026, LeakBase was dismantled during a coordinated international law enforcement operation, which resulted in the seizure of the forum’s infrastructure and the confiscation of its database of users and administrators (Computing, 2026).

Modus Operandi (MO)

Chucky’s activities primarily involved operating and maintaining infrastructure used to facilitate cybercrime, rather than conducting intrusions directly.

LeakBase functioned as a marketplace for breached information, allowing cybercriminal actors to upload, advertise, and distribute stolen data. The platform utilised a structured forum environment where users could browse leak categories, request datasets, or promote newly acquired breach material.

Data commonly hosted or distributed through LeakBase included:

• Database dumps
• Credential logs
• Stealer logs
• Hacking guides and services
• Breach announcements and data leak disclosures

Many of these datasets originated from vulnerabilities in web applications, misconfigured databases, or successful network intrusions conducted by third-party threat actors (Computing, 2026).

The forum employed a tiered subscription model, where users could pay for enhanced access to datasets or premium content. This monetisation model enabled Chucky and other administrators to generate revenue through the facilitation of illicit data trading.

LeakBase was also notable for being accessible on the clear web, rather than exclusively on the dark web, which reduced barriers to entry and broadened the platform’s user base (Cybernews, 2025).

Tactics, Techniques and Procedures (TTPs)

The behaviour associated with Chucky and the operation of LeakBase demonstrates several common tactics and procedures used by administrators of cybercrime marketplaces.

Infrastructure Management

• Administration of a cybercrime forum dedicated to leaked databases
• Hosting of breach announcements and leak repositories
• Maintenance of user accounts and forum moderation

Data Distribution

• Facilitation of the sale and sharing of stolen datasets
• Distribution of credential collections and stealer logs
• Organisation of breach data into searchable forum categories

Communication Channels

• Use of Telegram channels to distribute leaks and engage with community members
• Utilisation of encrypted or pseudonymous communication platforms for transactions and contact (Virus Bulletin, 2023)

Monetisation

• Implementation of subscription tiers for access to premium leaks
• Use of cryptocurrency-based payments for services and data access

Operational Security (OPSEC)

• Use of multiple online aliases across cybercrime forums
• Separation between infrastructure operators and data suppliers
• Reliance on pseudonymous identities and decentralised communication channels

Reputation within the Cybercrime Ecosystem

LeakBase gained recognition within cybercrime communities as a significant repository of breached data and credential collections. Security monitoring organisations identified the forum as a notable data leak marketplace due to the scale of information available and its active user base (Computing, 2026).

The forum’s appeal was partly derived from its structured marketplace format, which allowed cybercriminals to efficiently browse and acquire compromised data. Reports indicate that LeakBase hosted datasets containing hundreds of millions of compromised credentials and financial records originating from multiple breaches.

Despite its popularity, the reputation of Chucky within underground communities appears to have been mixed. As the forum gained notoriety, instances emerged where other actors attempted to impersonate or leverage the Chucky identity to conduct scams or fraudulent activities (SpyCloud, 2024).

Notably, in August 2025, Chucky claimed to have breached DarkForums, a rival cybercrime forum, and began publishing the data on his Telegram channel. The attack was allegedly carried out in response to AnonSec defrauding Russian users out of cryptocurrency.

Conclusion

Chucky represents a type of cybercriminal actor whose role focuses primarily on enabling and facilitating cybercrime rather than conducting direct attacks.

By operating LeakBase, the actor created an environment where stolen data could be easily distributed, monetised, and exchanged between threat actors. Platforms such as LeakBase contribute significantly to the cybercrime ecosystem by providing a structured marketplace that incentivises the theft and resale of sensitive information.

The international law enforcement operation that dismantled LeakBase demonstrates an increasing emphasis on disrupting cybercriminal infrastructure, which can have broader impacts on the underground economy than targeting individual attackers alone.

However, given the persistent demand for compromised data within cybercrime communities, it is highly likely that similar forums and marketplaces will emerge to replace LeakBase, continuing the cycle of illicit data trading.

References

• KELA Cyber Intelligence Center. (2026). Law enforcement seizes LeakBase.
• Computing. (2026). Cybercrime forum LeakBase dismantled in international law enforcement operation.
• Cybernews. (2025). LeakBase cybercrime forum taken down by authorities.
• Flare. (2023). Top cybercrime forums monitored by threat intelligence analysts.
• SpyCloud. (2024). Cybercrime underground activity update.
• Virus Bulletin. (2023). Sheep’s clothing: The deep dark web operators hiding in plain sight.

Introduction

Hello everyone! I hope you’re all enjoying the new site. I’m writing a quick article about a tool I recently developed called MailForge. It’s a Python script designed to parse messy data and transform it into structured email lists.

Why did I need this?

Laziness, of course! I wanted a way to quickly scrape a target organisation employees from sites like LinkedIn, copy the raw data into a file, and instantly generate a list of target emails for engagements.

For the tool to work, you simply need to know the email domain used by the target organisation, such as google.com.

Vibe Coding

I built this using an approach known as “Vibe Coding.” Coined by Andrej Karpathy, Vibe Coding is an AI-assisted development style where developers rely on Large Language Models (LLMs) to generate, debug, and iterate code entirely through natural language prompts, rather than writing it line-by-line.

As I mentioned, I’m lazy and needed a tool built quickly so I could start deploying it on engagements. Vibe coding can lead to issues, so would I trust it to build a mission critical project perfectly? Absolutely not. But in this case, it did the job!

How does it work?

MailForge was “vibe coded” with me manually testing the logic and checking the outputs. The key features include:

• Smart Name Parsing: Automatically extracts first, middle, and last names from various input formats.
• CSV & Text Output: Exports results in both CSV and plain text formats.
• Domain Customisation: Easily configures target email domains.
• Batch Processing: Processes hundreds of names from input files simultaneously.
• Lightweight: Pure Python 3 with no external dependencies.

Note: The tool can occasionally create false-positive emails. I’ve suggested in the repo that users should double-check the output and remove any inaccuracies.

Conclusion

This tool has already saved me a significant amount of time during penetration testing, allowing me to build email lists much faster than my previous manual methods. Are there better ways to code it? Most likely! But it works for me, and it isn’t bad for an evening’s work.

Feel free to check out the tool here:
MailForge

Thanks for your time!

Introduction

The Dark Web poses a significant challenge for law enforcement (LE), due to its anonymisation features. These features enable threat actors to operate with relative impunity, hosting illicit domains such as cybercrime forums, drug markets, and Data Leak Sites (DLS). Despite the growing presence of such platforms, there remains a notable lack of structured and direct education and resources available on how to effectively dismantle and takeover these domains. As a result, there is a growing demand for specialised training and support in this area.

This article will be discussing my dissertation project “VoidCore”, highlighting the common themes in attacks against Tor domains both from LE and threat actors.

What is the Dark Web?

The “Dark Web” is an umbrella term for a hidden part of the internet that a user cannot access without access to specific software. Since its creation, it has grown in both user base and illegal activity.

Iceberg of the webs

The Dark Web can be broken down into multiple technologies that fall under the umbrella. The most popular of which is Tor (The Onion Router). Other alternatives projects include I2P (The Invisible Internet Project) and Freenet.

The Onion Router

Tor was originally developed by the US Navy for covert communication in the 1990s, later becoming publicly available. Following this, a research and education organisation “The Tor Project” was established to manage the network and maintain the Tor Browser. The network operates by “nodes” which are volunteers donating their network connection to help strengthen the network. If a user wishes to access a Tor domain, it will pass through nodes that will add layers of encryption.

Law Enforcement Challenges

The Dark Web, unfortunately, causes major challenges for LE with a significant number of operations focused on battling illegal Tor domains, which remains difficult to control. The difficulties fall within the anonymity which Tor provides making it difficult for traditional policing tactics to be deployed. There are substantial barriers for LE when it comes to policing the dark web, causing them to always be on the back foot. The primary limitation for LE is simply the number of illegal domains and the amount of criminality making the task increasingly harder for LE.

LE entities typically exploit cyber security vulnerabilities and capitalise on poor OPSEC (Operational Security) against targeted domains. LE exploits the flaws for several reasons, such as gathering evidence, identify threat actors real-world identities and harvesting decryption keys. LE also use compromised Tor domains for reputational damage against threat actors; Typically defacing seized domains with a notice of seizure, which will affect the impacted domain’s reputation amongst cybercriminals. An example this can be seen below.

Breach Forums seizure notice (May 15,2024)

LockBit seizure

Several landmark actions have targeted the dark web. One particularly influential case inspired my dissertation is the seizure of the LockBit’s DLS.

LockBit’s compromised DLS

In February 2024, NCA (National Crime Agency) with partners disrupted LockBit, a Russian Ransomware-as-a-Service (RaaS) operation with Operation Cronos; This led to the seizure of the domain and gathered large sums of data such as affiliate names leading to numerous arrests. LE utilised the compromised domain to share several of their findings. According to the education and research group VX-Underground, LE allegedly compromised the domain via CVE-2023-3824, a PHP Buffer overflow flaw.

VX-Underground tweet

The findings

For VoidCore, I drew on a range of information sources, including research articles and law enforcement announcements. However, a key challenge was the limited technical depth in many of these references, which restricted the level of detail I could incorporate.

Please note, that these findings come from my independent research and I have had no collaboration with others or organisations including LE. My findings have not been peer-reviewed. Overall, I would like to say my findings give a good picture however I likely missed some things! My findings also only dated to May 2025.

The top vulnerabilities as shown above are the following:

1. Infrastructure misconfiguration = 22%
2. SQLi = 22%
3. Access into infrastructure = 15%
4. Compromising database = 15%
5. Cross-site-scripting (XSS) = 11%
6. OTHER = 15%

VoidCore

The theme of VoidCore is a ransomware Data Leak Site (DLS). The design of the domain took inspiration from LockBit’s DLS.

For hosting the domain, an AWS EC2 instance was utilised. As previously discussed, the domain had the most common vulnerabilities implanted into it, which are the following:

1) Infrastructure misconfiguration

The sever-status endpoint was left accessible, exposing sensitive information such as the server’s IP address, software version, active connections, and other diagnostic data. In a real-world scenario, this misconfiguration could significantly aid law enforcement and may be used to potentially seize the a Tor domain.

VoidCore server-status exposed.

VoidCore server-status exposed.

2) Cross-site scripting (XSS)

A XSS vulnerability exists within the “victims” search bar. This flaw could opening the door to allow LE harvest session tokens thereby identifying perpetrators and gaining access to their accounts.

VoidCore XSS Flaw

3) SQL Injection (SQLi)

The login portal for affiliates and the operations leader “VoidSoup” is vulnerable to SQLi, which allows access to accounts and access data.

VoidCore SQLi

Conclusion

The dark web continues to pose a significant challenge for LE. Despite growing efforts from governments, threat actors show no indication of fully abandoning Tor. A major contributing factor to this issue is the lack of accessible education and training on how to combat the illegal domains.

Thanks for reading, hope you found it interesting!

Disclaimer

Please note that I am not qualified within Cyberpsychology, nor do I have any experience, however I have found the area fascinating and decided to write this.

What is it?

Cyberpsychology is the study of people’s interactions and emotions with digital devices and others within cyberspace. This field is relatively new and constantly evolving with technology.

How did it start?

Cyberpsychology started in the 1990s but quickly gained relevance during the 2000s with the rise of social media platforms and the involvement of technology in our everyday lives. Over the past several years, the area has grown in popularity.

What does a Cybersociologist do?

A Cybersociologist specialises in the study of humans in the context of digital technology. This role can involve combining various fields such as computer science and forensics. Typically, Cybersociologists work within universities and can also be seen working for government agencies such as Europol.

The private sector also employs Cybersociologists, an example of this could be to increase social media effectiveness for an organisation.

Key areas?

There are multiple areas within Cyberpsychology, some of these include:

Online Identification and Behaviour – This area is where Cybersociologists explore how people create and manage their online identities and the psychological significance behind them. This includes analysing how people act more harmful online and take higher levels of risk when they have anonymity.

Social Media Behaviour – This area researches the impact of social media on our mental health and well-being. This could can include research into how individuals suffer more negative mental wellbeing after longer term use of the internet.

Cyberbullying and Online Harassment – This is the study of the causes and issues that arise from cyberbullying, this field of study intends to offer insights into harassers and apply intervention strategies.

Online relationships – Cybersociologists analyse human relationships online which were developed virtually. This area conducts the comparison between virtual and real-world interactions, with the associated benefits and negatives.

Cyberpsychology within Cyber Security

How many times have you read about organisations being compromised through social engineering attacks? Too many to count?

Threat actors exploit psychological principles in social engineering attacks. For example, they use scarcity (“Act within 5 minutes!”) in phishing emails, or impersonate authority figures within organisations to manipulate victims. All these methods take advantage of our built in human emotions.

Training is one the most effective and cost-effective method to battle this, the involvement of Cybersociologists within our organisations can reduce cyber incidents and provide effective training in potential victims recognising the weaponisation of psychological factors in attacks.

Final thoughts

Overall, personally, I find Cyberpsychology an interesting field it can have a positive impact on organisations to factor into training to potentially reducing cyber incidents. I feel with the development of AI and virtual reality, Cyberpsychology roles and implications will increase.

Shout out!!!

A massive thank you to Sharan Kauldhar A second-year BSc (Hons) Cyberpsychology student at Bournemouth University. She helped me write this article and ensured I wasn’t chatting rubbish.

I highly recommend you check out her LinkedIn account as she has amazing knowledge about the area. Thanks for your time!

Introduction

MongoDB? What is this? MongoDB is an open-source document-orientated NoSQL database management program. The software application is designed for scalability and large-scale data storage.

Yes, your guess is correct, threat actors love to target the instances with many publicly accessible.

This article will highlight a vulnerability disclosure I performed, finding exposed sensitive data from an organisation’s MongoDB database.

The Hunt Begins!

Threat actors can identify publicly accessible MongoDB instances in several ways. In this article, I will show the Shodan method.

The below Shodan query will display all successful requests to MongoDB databases; Allowing threat actors to identify exposed databases.

 "Set-Cookie: mongo-express=" "200 OK"

The current results as of (22/10/24) are the following:

• 357 exposed instances.
• The top countries are the follow, Germany, the United States, China, France and Singapore.
• 284 of the exposed instances are operating on port 8081.

The Disclosure

Please note, that impacted party was provided with a detailed report on the findings and has successfully fixed their instance being exposed.

The impacted party operates within the logistics sector. The data found potentially could have been abused for third-party compromise.

Exposed MongoDB instance.

This is just one example of multiple of a vulnerability disclosure I have conducted with exposed MongoDB instances.

In one previous case, I found an organisation exposing clear text email addresses, passwords, credit card information and SSH keys.

How to fix?

Simply put, basic mitigation authentication practices would prevent a threat actor from accessing the instance. Please see the following article for steps.

Conclusion

Overall, exposed MongoDB instances can spell disaster for an organisation. The low skill required for a threat actor to access an exposed instance makes it popular amongst threat actors.

Thanks for your time!

Introduction

Heartbleed? What is Heartbleed?

Heartbleed tracked as CVE-2014-0160, is a critical vulnerability in OpenSSL cryptographic software library. Threat actors can abuse this flaw to trick a victim system into providing sensitive data, such as passwords and RSA keys.

Yes, you are reading this right. This vulnerability is 10 years old. This is the story about my disclosure I made about a vulnerable instance to Heartbleed.

The Hunt Starts!

Threat actors can identify instances vulnerable to Heartbleed in several ways; In this instance, I was exploring Shodan with the following query to identify the vulnerable instance.

Please note Shodan will return instances which aren’t vulnerable, so you will need to dig into the results.

vuln:CVE-2014-0160

Current results:

Shodan results 20/11/24

The Disclosure

Please note that the impacted party operates a vulnerability disclosure program and has successfully mitigated the vulnerability before this article was published.

The impacted party for this disclosure was a major US educational institution.

Exploiting this vulnerability is simple after identifying a vulnerable instance, this is because Metasploit has a built-in exploit.

Exploitation Steps

msfconsole

use auxiliary/scanner/ssl/openssl_heartbleed

show options

set rhost (INSERT IP HERE)

exploit

The Results

How to fix?

Update vulnerable OpenSSL instances to the latest versions, this will prevent exploitation.

Conclusion

This case highlights that old vulnerabilities can still wreak havoc on organisations. The skills required to conduct this cyber-attack are relatively low, with Metasploit built-in exploit.

Thanks for your time!

Introduction

The modern-day fraudster has developed their own slang and terminology, and while this language helps threat actors communicate and conduct operations; It can be difficult and alien for an us “good guys” to understand.

Hopefully, this breakdown will help fill some of your knowledge gaps!

Terminology

Fullz: Full information, typically referring to a victim’s stolen bank card or identification.

Method: A way for a threat actor to conduct fraud, such as getting free designer clothing.

Proofs: Evidence of the legitimacy of a method, aka proving a method works.

Mainstream / Highstreet: Refers to Highstreet banks, such as Barclays and NatWest.

Logs: Text files containing compromised account details, such as a retail store victim’s login details.

Chop: Selling stolen bank accounts.

White cards: Cards loaded with a stolen bank account (The cards are commonly plain white).

F2F: Face to Face meeting, a fraudster meeting another person in real life.

Holder: An owner of an account, such as a bank account.

Loader: A person who puts money into an account, typically to conduct fraud.

Vishing: Conduct fraud through voice or calls.

SIM Swapping: A threat actor take control of a victim’s SIM card.

Addy: Address, this could be a real location or point of contact like an email address.

Mule: Someone to move dirty money through, allowing a threat actor to cash out more “safely”.

White names: English white names, commonly requested to conduct fraud attacks.

E-Whoring: Pretending to be a female online, tricking victims into sending money for adult content.

Pig Butchering: A scam designed to drain all the financial funds a victim holds. (Also known as “Sha Zhu Pan”).

Conclusion

The above terms are just some seen in use amongst cybercrime locations. Want to learn more? Check out my BSides Leeds talk on “Cyber Fraud Landscape” which is a great introduction to the landscape!

• Researchers have identified a new post-exploitation tool dubbed “Splinter”, which is written in Rust.
• Currently, the researchers have not identified the developer behind the toolkit. Additionally, no threat actor has been observed using Splinter in the wild.
• Features of Splinter includes, executing Windows commands, process injection, harvesting of account information and uploading files.

My thoughts: While Splinter has not been observed in attacks in the wild, it highlights the importance of organisations needing to stay alert to the latest developments in tooling.

Increasingly threat actors are utilising Rust to create malware, some reasons for this includes efficiency, difficulty to reverse engineer, and memory safety functionality.

IoC:

1962cef10cf737300d04a23139122abcc8e8803e54dfcb63054140fbe549bed0

Reference:

https://unit42.paloaltonetworks.com/analysis-pentest-tool-splinter/