I wasn't going to post anything more today, but this one really sunk in and I reaped the rewards.. Friday…
PETER D. — Cybersecurity / Threat Researcher / Breaker of All Things / Discovered a 563-Node Global Botnet
I wasn't going to post anything more today, but this one really sunk in and I reaped the rewards..
Friday afternoon. Mid-session. Alert fires.
Live IAB operator. Healthcare credential harvesting. Caught in the act.
But here's the part that matters — I've been tracking this guy for three months.
Three months of quiet work. Infrastructure mapped. SSH fingerprints confirmed across multiple sessions. Darknet handles attributed. Sector targeting profiled. Country, ISP, subnet — all confirmed long before today.
So when the alert fired this afternoon, attribution was already built. We knew exactly what we were looking at before the Discord notification finished loading. No scrambling. No guessing. Just confirmation of what the platform already knew.
What happened today:
The actor grabbed a credential document from a darknet source. Healthcare SSH credentials. Extracted them. Tried to use them against what he thought was a real target.
Then came back FOUR DAYS LATER with the same credentials and tried again.
That four-day gap is everything. That's not a scanner. That's not automation. That's a human being with a spreadsheet, working through a target list methodically, pre-positioning credentials for an access sale. Textbook IAB behaviour.
And this is the part that made me actually get up from my desk — this was my THIRD government disclosure today. Same day we had active ransomware campaign intelligence across two other sectors simultaneously.
Sector convergence is real. Healthcare is getting hit from every direction right now — ransomware operators and the IABs feeding them are operating in parallel. Today I caught one of the feeders.
Three months of tracking. Three months of the platform doing its job quietly. One afternoon to confirm everything.
Deception catches what detection misses. No rules. No alerts. No signatures. Just infrastructure, patience, and a very stubborn platform.
Built this solo. Still standing. Still catching.
Ask me anything.
3 reactions · 3 comments
Comments
Laurent H.: Healthcare is under siege right now and it takes professionals like you working quietly in the background to hold the line. The Cyberr community salutes you. 🫡
PETER D.: Laurent Halimi thank you for the kind words. Mr.Halimi. I'm just trying to do my part and do what we should be doing.. exposing the holes and raising awareness. I also try and promote banter, which is a lost art.. we need to TALK more amongst ourselves and work together.
Laurent H.: Pete Desfigies Couldn't agree more and this is exactly why Cyberr exists. You're not just catching threats. You're setting the tone. And we're here for it. 🔒