Cyber Threat Actor: ElliotAlderson

ElliotAlderson isa threat actor known by that alias and has been publicly linked to operations originating from China. The actor first came to attention in 2018 when personal data belonging to the chairman of India’s Telecom Regulatory Authority was disclosed after a public challenge on social media. Using the Twitter handle @fs0c131y, ElliotAlderson shared redacted screenshots that included the chairman’s address, date of birth, mobile numbers, PAN card number and WhatsApp profile picture, illustrating the risks associated with publishing biometric identifiers. This incident occurred amid broader debates about Aadhaar’s privacy safeguards and was reported by multiple Indian news outlets.

In a separate operation dated September 2018, ElliotAlderson compromised the website asankadr.az and exfiltrated a database containing 5,926 usernames alongside their hashed passwords. The dump was made publicly available, indicating a focus on credential harvesting rather than immediate financial gain or destructive impact. No specific malware families or exploit kits were referenced in the reporting of this breach, suggesting the actor relied on web application vulnerabilities to gain access. The method of initial access was not detailed in the public sources, but the outcome consisted of a straightforward credential leak.

The actor’s observed tactics involve leveraging social media platforms to amplify the impact of data exposures and employing web‑based attacks to obtain authentication material from online services. There is no publicly available information linking ElliotAlderson to a specific state sponsor, criminal syndicate or ideological group, nor are there details about the actor’s size, funding or technical sophistication. Consequently, any inference about strategic objectives such as espionage, financial profit or disruption would exceed the evidence provided.

Given the confirmed incidents, ElliotAlderson demonstrates a pattern of targeting government‑related entities in India and unspecified online services in Azerbaijan, with actions centered on data disclosure and credential collection. The actor’s known activities remain limited to these two reported episodes, and further characterization would require additional verifiable information.