Cyber Threat Actor: Mr. Mugger

Mr.Mugger is the alias used by a threat actor whose known location is Nepal. The actor first came to public attention through a specific cyber incident involving a Nepal‑based food delivery service. No other aliases or geographic ties have been documented in open sources.

On March 7 2020 the actor compromised the web application of the food delivery platform, gaining unauthorized access to customer records that included names, physical addresses, email addresses, and phone numbers. Approximately fifty thousand of these records were subsequently posted to Twitter by the actor using the Mr. Mugger identifier. The affected company reported that it promptly addressed the security vulnerability, engaged with Nepal’s cybercrime unit, and confirmed that its operations were not disrupted by the breach.

The observed tactics, techniques, and procedures consist of exploiting a web‑application vulnerability as the initial access vector, followed by data exfiltration and public disclosure via a social‑media platform. No malware families, custom tooling, or additional intrusion steps have been referenced in the reporting of this incident. Consequently, any further detail about the actor’s tooling repertoire remains undocumented.

Publicly available information does not establish any state affiliation, criminal consortium, or broader campaign linkage for Mr. Mugger. The actor’s activity to date is limited to the single reported breach, and no additional operations or attributions have been verified.