Cyber Threat Actor: IAMLUPO

IAMLUPO, also known by the alias Lupo, is a threat actor that has been referenced in open‑source reporting under both names. The aliases appear together in the description of a single cyber intrusion that occurred in 2014. No additional aliases or alternative identifiers have been disclosed in publicly available sources. The actor’s geographic location is noted as Russia, based on the same reporting that attributes the intrusion to the name IAMLUPO. Beyond this location and the naming convention, no further personal or organizational details about the actor have been made public.

On 15 October 2014, IAMLUPO claimed responsibility for compromising the website of the Sri Lankan Consumer Affairs Authority, identified by the domain caa.gov.lk. The claim stated that the actor had obtained a database containing 20,699 distinct username and password pairs from the site. The credential set was subsequently dumped, meaning it was placed in a publicly accessible location where anyone could retrieve it. The disclosed figure of 20,699 accounts represents the total number of unique login combinations that were exposed in this incident. No information about the specific malware, exploit tools, or initial access vectors used in the breach was included in the public account. The event remains the sole publicly documented operation linked to the IAMLUPO alias.

Because only this one incident is verifiably attributed to IAMLUPO, no broader patterns of targeting, preferred tooling, or strategic objectives can be inferred from open sources. The actor’s known location in Russia does not, by itself, indicate a state sponsor, criminal consortium, or any other affiliation. Any attempt to describe the actor’s typical victims, motives, or technical repertoire would rely on speculation rather than evidence. Accordingly, this profile is confined to the confirmed facts of the alias set, the Russian location, and the credential dump against the Sri Lankan Consumer Affairs Authority. This concludes the summary based solely on the verifiable information at hand.