Yesterday I broke the story of a young DOGE staffer’s past providing digital infrastructure to cybercriminals. Here’s a bit on how I ran the story down and how threat intel services like @domaintools.bsky.social and any.run can help. 🧵 - ThreadSky

raphae.li • 3 days ago

Yesterday I broke the story of a young DOGE staffer’s past providing digital infrastructure to cybercriminals. Here’s a bit on how I ran the story down and how threat intel services like @domaintools.bsky.social and https://any.run can help.

🧵

Reposted from Raphael Satter

New: The 19-year-old technologist who has become one of the best known members of Elon Musk’s US DOGE Service was providing digital infrastructure to a cybercrime ring as recently as two years ago.
www.reuters.com/world/us/dog...

Comments

raphae.li•3 days ago

The story begins on Telegram, where a group called EGodly posted boasts about SIM swaps, hacking law enforcement emails to issue EDRs, and — most strikingly — harassing an FBI agent they believed was after them. I wasn’t able to confirm all their activities, but I could corroborate some of it.

raphae.li•3 days ago

Among the incidents I was able to confirm: the harassment of the FBI agent. Here’s a clip they posted to their Telegram feed of someone shouting out the window as they drive past the agent’s purported address in Wilmington, Delaware.

raphae.li•3 days ago

I went in person and verified that that was indeed the agent’s (now former) address. I also spoke to a person who’d been at the receiving end of EGodly’s abuse and a cybercrime researcher who tracked the group to verify that these were in fact malicious actors. Or, as the agent told me, “bad folks.”

raphae.li•3 days ago

EGodly was involved in running a breach data search engine — which they sometimes called Celsus — and in early 2023 they made an announcement that seemed significant.

raphae.li•3 days ago

DiamondCDN had already been publicly identified by @reuters.com as one of Coristine’s companies, but how to verify EGodly’s claim? Granted, it was made in 2023 — well before Coristine was widely known — but the statement still bore checking.

https://www.reuters.com/world/us/young-techies-underpin-musks-drive-slash-size-us-government-2025-02-05/

raphae.li•3 days ago

Unfortunately, my first port of call @archive.org didn’t have great records of the dataleak site, so I checked @domaintools.bsky.social’s screenshot history instead. It’s nowhere near as complete as @archive.org, but I find its coverage is getting steadily better.

Here’s what it had for 1/18/2023:

Comments

Posting Rules

Reply