Coldzer0

Profile narrative

The threat actor referenced in the forum discussion has not been publicly identified by an alias or any other name. The actor claimed responsibility for obtaining and releasing a copy of the user database from the vbulletin.com website. According to the forum post, the actor stated that approximately 479,895 user records were included in the dumped data. The actor also offered to search the leaked data for specific usernames upon request from other forum participants.

The forum conversation in which the claim appeared included a comment that the disclosed figure of 479,895 users differed from the numbers shown on the forum itself, with one participant noting a discrepancy between the actor’s claim and the visible data. Another participant remarked that, if the claim were accurate, it would represent the second data leak they had encountered in recent days. The discussion did not provide any technical details about how the data was obtained, what tools or malware were used, or how the information was exfiltrated from the target system.

No information about the actor’s geographic location, organizational affiliation, or possible sponsors is present in the source material. The discussion does not mention any specific industry sectors, geographic regions, or strategic objectives such as financial gain, espionage, or disruption that might motivate the activity. Likewise, no malware families, exploit tools, or particular initial access vectors are described in the exchange.

Consequently, the only verifiable facts about this threat actor from the available source are the claim of possessing a vbulletin.com user database containing roughly 479,895 records and the public offer to query that data. Any further characterization of the actor’s motives, capabilities, affiliations, or campaign history would require additional evidence beyond the provided forum excerpt.

Incidents

Attributed incidents are available to members.