rogue0

Profile narrative

rogue0, also known as ProTag and Rogue0, is a threat actor whose activity has been linked to Russia based on available reporting. The actor has targeted online collectibles marketplaces and political participation platforms, specifically the Quidd marketplace and the Movimento 5 Stelle’s Rousseau system. In the Quidd incident the actor first offered the stolen user database for sale, while in the Rousseau incidents the actor published donor information and hinted at access to newer database tables. The actor has advertised stolen data on hacking forums and Pastebin, used Twitter to announce breaches, and employed Privatebin.net to share leaks while attempting to avoid attribution. No specific malware families, exploit kits, or initial‑access vectors are described in the sources; the reported activity focuses on obtaining and disseminating database contents.

Attribution to a state sponsor or a criminal consortium is not present in the public material, with only the actor’s presumed Russian location noted. The most prominent campaigns include the December 2019 breach of Quidd that exposed approximately four million usernames, email addresses and bcrypt‑hashed passwords, and the September 2018 intrusion into Rousseau that revealed names, email addresses and donation amounts of several contributors and implied access to recent tables such as rsu_academy_proponi_corso and rsu_candidati_2018. An earlier 2017 compromise of Rousseau is also referenced, showing a pattern of repeated targeting of the same platform. The Quidd breach specifically noted that passwords were protected with the bcrypt algorithm, rendering plaintext recovery computationally infeasible. These incidents collectively illustrate the actor’s reliance on database exfiltration, public forum advertising and social‑media claiming as core elements of their operation.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 2 sources.