Cyber Threat Actor: u/orange_calvin

The threat actor known by thealias u/orange_calvin has been publicly linked to activity originating from the United States of America. This identifier appears in connection with a coordinated account takeover campaign that targeted moderator accounts on the Reddit platform. No additional aliases or geographic details have been disclosed in open sources.

In August 2020 the actor compromised multiple moderator accounts that lacked two‑factor authentication, using this credential‑based initial access to deface numerous high‑traffic subreddits. The defacement replaced the normal content of these communities with pro‑Trump reelection messages, affecting subreddits covering sports leagues, entertainment franchises, cities, and educational forums and reaching tens of millions of subscribers. Reddit’s security team responded by restoring control of the compromised accounts and removing the unauthorized posts, while an unverified Twitter account that claimed responsibility was subsequently suspended. The incident followed Reddit’s earlier removal of a pro‑Trump community for harassment and bullying violations and resembled similar defacement tactics observed on another online gaming platform.

No further publicly reported operations, malware families, tooling specifics, or affiliations have been attributed to u/orange_calvin. Consequently, any assessment of broader campaign patterns, state connections, or criminal consortium ties remains unsupported by the available evidence. The profile is therefore limited to the confirmed facts surrounding the Reddit account takeover and defacement activity described above.