USDoD

Also known as: NetSec, Operation “Data Breach”, ScarFace_TheOne, USDoD

USDoD is a threat actor known for leaking large databases of personal information, including from companies like Airbus and the U.S. Environmental Protection Agency. They have a history of engaging in high-profile data breaches, such as exposing data from the FBI’s InfraGard program. USDoD has also been involved in web scraping to obtain information from websites like LinkedIn.

🌍 Country ["Spain"]

Associated Operations

2022-12 2023-09 2024-04 2024-07 Airbus investigates data leak allegedly involving thousands of suppliers FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked Hackers leak 2.7 billion data records with Social Security numbers Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/ https://therecord.media/airbus-data-leak-suppliers-breachedforums https://www.bleepingcomputer.com/news/security/hackers-leak-27-billion-data-records-with-social-security-numbers/ https://www.crowdstrike.com/en-us/blog/hacktivist-usdod-claims-to-have-leaked-threat-actor-list/

Introduction

USDoD is a threat actor known for leaking large databases of personal information, including from companies like Airbus and the U.S. Environmental Protection Agency. They have a history of engaging in high-profile data breaches, such as exposing data from the FBI’s InfraGard program. USDoD has also been involved in web scraping to obtain information from websites like LinkedIn.

Activities and Tactics

Country of Origin: 🏳️ [“Spain”]

Notable Campaigns

  • 2022-12
  • 2023-09
  • 2024-04
  • 2024-07
  • Airbus investigates data leak allegedly involving thousands of suppliers
  • FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked
  • Hackers leak 2.7 billion data records with Social Security numbers
  • Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List
  • https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/
  • https://therecord.media/airbus-data-leak-suppliers-breachedforums
  • https://www.bleepingcomputer.com/news/security/hackers-leak-27-billion-data-records-with-social-security-numbers/
  • https://www.crowdstrike.com/en-us/blog/hacktivist-usdod-claims-to-have-leaked-threat-actor-list/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

Information pending cataloguing.

Attribution and Evidence

Country of Origin: [“Spain”] Additional attribution information pending cataloguing.

References

References pending cataloguing.