IntelOps retweeted
OSINT =! Doxxing.
Now that we've established what OSINT isn't, let's explore what OSINT actually is.
OSINT stands for Open Source Intelligence.
Let's break that down.
Open Source: In this context, think non-classified or publicly accessible information.
It has nothing to do with open-source software or code.
It simply means information that members of the public could potentially access and gather.
Intelligence: Data with a story.
An example I like to use is weather data. On its own, weather data is just data. But when you collect, collate and analyse it over time, you can identify patterns and trends that provide evidence of climate change.
That's when data becomes intelligence: when you turn information into something meaningful.
And here's where the misunderstanding often begins: OSINT doesn't just apply to people.
It can be used to monitor weather patterns and make predictions, audit financial logs to identify discrepancies, track public events, analyse trends, support scientific research, and much more.
Doxxing can utilise OSINT, yes.
But OSINT itself is a much broader discipline than doxxing.
In fact, almost everything in penetration testing and scientific research utilises OSINT to some degree.
To reduce OSINT to nothing more than stalking is to fundamentally misunderstand the discipline and dismiss the work of countless professionals.
Intelligence analysts, police officers, crisis counsellors, data scientists, security researchers and many others rely on OSINT and intelligence-gathering techniques in their work.
Doxxing is a misuse of information. It is not the definition of OSINT.
The two are not interchangeable, and treating them as such does a disservice to an entire field of work.
Now that we've established what OSINT isn't, let's explore what OSINT actually is.
OSINT stands for Open Source Intelligence.
Let's break that down.
Open Source: In this context, think non-classified or publicly accessible information.
It has nothing to do with open-source software or code.
It simply means information that members of the public could potentially access and gather.
Intelligence: Data with a story.
An example I like to use is weather data. On its own, weather data is just data. But when you collect, collate and analyse it over time, you can identify patterns and trends that provide evidence of climate change.
That's when data becomes intelligence: when you turn information into something meaningful.
And here's where the misunderstanding often begins: OSINT doesn't just apply to people.
It can be used to monitor weather patterns and make predictions, audit financial logs to identify discrepancies, track public events, analyse trends, support scientific research, and much more.
Doxxing can utilise OSINT, yes.
But OSINT itself is a much broader discipline than doxxing.
In fact, almost everything in penetration testing and scientific research utilises OSINT to some degree.
To reduce OSINT to nothing more than stalking is to fundamentally misunderstand the discipline and dismiss the work of countless professionals.
Intelligence analysts, police officers, crisis counsellors, data scientists, security researchers and many others rely on OSINT and intelligence-gathering techniques in their work.
Doxxing is a misuse of information. It is not the definition of OSINT.
The two are not interchangeable, and treating them as such does a disservice to an entire field of work.
OSINT is stalking.
Social engineering is just an innocent name for committing fraud and lying to people.
The other stuff is just boring.
Except vulnerability mitigation. Figuring out mitigations that eradicate entire vulnerability classes are hot af.
3
14
78
2,332
IntelOps retweeted
the BYOD ransomware group has listed Michigan State University on its leak site, claiming full PII for 1.03 million current and former students plus staff, including current and former passwords, along with a full system compromise. The group’s post includes an extortion message act before the breach “scales further.”
claim unverified
claim unverified
2
1
26
1,380
IntelOps retweeted
If you want the full context on why we turned down the takedown request, we wrote it all up here: blog.flokinet.is/2026/10/29/ice…
US Department of Homeland Security (DHS) has asked Icelandic web host FlokiNET to take down a site with data on tens of thousands of employees, including ICE personnel. FlokiNET refused, citing a "legitimate" public interest. aje.news/b21ca4
61
580
3,478
124,749
@Alph4betSoup cybersecurity awareness month is the longest year of 2026
1
0
1
40
IntelOps retweeted
Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: x.com/zachxbt/status…
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked TraiderTraitor, other previous exploits such as Kelp DAO.
Commingling address:
0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7
Bitget exploit context: x.com/zachxbt/status…
BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use.
Notably, Alias 4 (below) was also seen he Kelp DAO $292M exploit earlier this year.
I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks.
Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi.
Alias 1 - Cc
Discord: cc02006
Discord ID: 1351486674386948148
Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363
Alias 2 - jack
Discord: jack_34808
Discord ID: 1553705721768714377
Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69
Alias 3 - Melon
Discord: under0346
Discord ID: 1394240539108573215
Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F
Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B
Alias 4 - lolo / Marin
TG: pvpcz
TGID: 6223514198
Discord: losern
Discord ID: 1024415186527985704
Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15
Alias 5 - HELP ME
Discord: helpme031897
Discord ID: 1554035533817188384
Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379
187
435
3,182
496,374
IntelOps retweeted
Code-execution flaw in UEFI firmware affects most servers on planet Earth: arstechnica.com/security/2026/…
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
Great work by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)!
4
23
58
7,710
IntelOps retweeted
the WhiteArmor ransomware group has listed crypto swap platform Wagyu with a demand of $5,000,000
"We hold 38,628 orders and 10,139 IPs from Wagyu (@PerpetualCow): wallets, sessions, fingerprints, countries, $907M XMR-heavy volume."
"We hold 38,628 orders and 10,139 IPs from Wagyu (@PerpetualCow): wallets, sessions, fingerprints, countries, $907M XMR-heavy volume."
12
11
135
13,890
IntelOps retweeted
ADVANCED OSINT WITH BELGIUM’S FCCU 🇧🇪
We spent three days with Belgium's Federal Computer Crime Unit analysts covering advanced attribution, verification and OpSec.
Thanks to our trainer @OSINT_Tactical and @policefederale FCCU analysts.
We spent three days with Belgium's Federal Computer Crime Unit analysts covering advanced attribution, verification and OpSec.
Thanks to our trainer @OSINT_Tactical and @policefederale FCCU analysts.
3
5
25
5,536