Cyber Threat Actor: PhotonicProton

The threat actor is known by the alias Photon. Another alias used by the same actor is PhotonicProton. Public reporting indicates the actor’s location is China, though this is noted as “if known.” These identifiers have appeared in connection with a specific intrusion event. No other aliases or geographic details are publicly attributed to the actor at this time.

On October 31, 2015, the actor operating under the alias PhotonicProton compromised the website mac-torrents.com. The intrusion involved gaining unauthorized access to the site’s user database. Following the breach, the actor exfiltrated a substantial volume of account information. The extracted dataset comprised nearly ninety‑five thousand individual records. Each record contained a username and an associated hashed password. The actor subsequently published the dumped data, making it publicly accessible.

The compromised data consisted of usernames and hashed passwords. This credential information was made public after the breach. The event is recorded in open‑source threat feeds as an attributed incident for the actor. No additional intrusion incidents, malware families, or tooling have been publicly associated with the actor. Therefore, the publicly documented activity of the actor is limited to this specific compromise. No further details about the actor’s affiliations, capabilities, or subsequent actions are available in the public domain.