Cyber Threat Actor: Impotent

Impotent is an alias used by an individual known to reside in the United States of America. This actor is identified as an administrator of the hacking forum called Exposed. On May 29, 2023, Impotent leaked a database containing member information from the RaidForums hacking forum. The leak was shared publicly on the Exposed forum and quickly drew attention from security researchers and threat actors.

The leaked file is a SQL dump of the mybb_users table, which stored registration data for RaidForums members. It contains information for 478,870 users, including usernames, email addresses, hashed passwords, registration dates, and various other fields tied to the forum software. The data covers accounts created between March 20, 2015, and September 24, 2020, reflecting the period when the original dump was likely taken. Impotent stated that some entries were removed from the database to avoid causing drama, while retaining approximately ninety‑nine percent of the original lines. The actor explained that the dump was not originally intended for public release but decided to share it yesterday, knowing its source but refusing to disclose any details about where it came from.

RaidForums had been a prominent platform for trading, leaking, and selling data stolen from breached organizations before its seizure in April 2022. The forum’s administrator, Omnipotent, and two accomplices were arrested during that international law enforcement operation. After the shutdown, many users migrated to a successor forum named Breached, which itself ceased operations in March 2023 following the arrest of its founder, Pompompurin. Exposed emerged shortly after Breached’s demise to fill the void left for those seeking a venue to exchange stolen data. The publication of the RaidForums member database by Impotent provides researchers with a concrete set of registration details that can be used to build profiles of individuals who frequented the original forum. Although law enforcement likely already possesses similar data from the seizure, the leaked information remains valuable for linking accounts to other malicious activities and for understanding the historical user base of RaidForums.