Cyber Threat Actor: Angel_of_Truth

Angel_of_Truth is the alias used by a threat actor that has been publicly linked to a cyber intrusion against a Canadian mining company. The actor’s location is noted as Canada in the available reporting, although no further geographic details are provided. The alias appeared in a paste accompanying the data leak and was used to claim responsibility for the attack. No other aliases or identifiers have been disclosed in the open sources examined.

The only confirmed targeting incident involves Detour Gold Corporation, a firm listed on the Toronto Stock Exchange, which operates in the mining sector. The actor stated that the operation was motivated by retaliation for Canada’s sanctions on Russia and its support of Western policies, indicating a political objective rather than financial gain or traditional espionage. The threat actor sought to influence Canadian foreign policy by threatening further releases of stolen data unless the government altered its alignment. No evidence points to a profit‑driven motive or to the theft of intellectual property for commercial advantage.

The public reports do not describe any specific malware families, initial access vectors, or tooling associated with Angel_of_Truth. Details about how the actors gained entry, what tools they used to maintain persistence, or how they exfiltrated data are absent from the sources. Consequently, no technical tactics, techniques, or procedures can be affirmed from the material at hand. The absence of such information means that any discussion of TTPs would be speculative and therefore omitted.

Attribution to a state sponsor, criminal consortium, or other organized group is not established in the available documentation. The actor’s self‑expressed linkage to Russian sanctions does not constitute a verified state nexus, and no affiliations with known hacking collectives are mentioned. As a result, the actor remains unattributed beyond the alias and the stated political rationale. The only publicly reported operation attributed to Angel_of_Truth is the prolonged intrusion into Detour Gold Corporation’s network, which lasted over two years and resulted in the exfiltration of employee records, medical complaints, disciplinary reports, supervisors’ personal information, incident documentation, and gold shipment details. Portions of this data were released publicly, and the actor warned of additional leaks unless their demands were met. This incident stands as the sole confirmed campaign in the open‑source record.