Chief
Attribution profile
- Type
- Sensationalist
- Location
- United States of America
- Known incidents
- 2 incidents
- Sources
- 2 sources
- First seen
- 2015-01-26
- Last seen
- 2015-04-05
- Updated
- 2026-10-14 15:56
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Chief, also known as @Puttied, is a threat actor based in the United States who has targeted educational institutions. In April 2015 the actor disclosed a cross‑site scripting vulnerability on a Northwestern University subdomain and subsequently used SQL injection to obtain administrator credentials, which were posted online while the university confirmed no personal data was exposed. Earlier in January 2015 and again in April 2015 the actor claimed responsibility for SQL injection attacks on Wellesley College servers, dumping MD5‑hashed login credentials for approximately seven hundred users and sharing the data on Pastebin and Twitter, including a link to an MD5 decryption service. The actor’s observed tactics involve initial access through web‑application flaws such as XSS and SQLi, followed by credential disclosure via public paste and social‑media platforms. No public attribution to a state sponsor or criminal consortium has been made, and the actor’s stated objectives beyond credential exposure are not described in the available sources.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 2 sources.