nclay

Profile narrative

The threat actor known by the alias nclay operates as a vendor on dark web marketplaces, most notably the Hansa platform, where they have offered stolen data for sale. This alias appears in public reporting as the identifier used by the individual or group claiming responsibility for the acquisition and distribution of the Edmodo user database. No additional aliases or affiliations are mentioned in the available source material, and no state or criminal consortium links are publicly attributed to nclay at this time.

The actor’s observed targeting focuses on the education technology sector, specifically the Edmodo platform which serves teachers, students, and parents worldwide. The strategic objective evident from the reporting is financial gain, as nclay listed the stolen Edmodo database on Hansa for just over one thousand United States dollars, indicating a motive to profit from the sale of the compromised data. No explicit statements regarding espionage, disruption, or other ideological goals are present in the source material, so any inference beyond financial motivation would be speculative.

The most notable operation attributed to nclay involves the alleged theft and subsequent sale of approximately seventy‑seven million Edmodo accounts, of which roughly forty million include associated email addresses, according to the vendor’s own dark web listing and corroborated by LeakBase. The vendor claimed the data was stolen the month prior to the listing and offered it for sale, prompting Edmodo’s public acknowledgment of a potential security incident and its subsequent investigation. The source material does not reference any specific malware families, initial access vectors, tooling patterns, or attribution details, so those aspects of the actor’s profile remain unspecified based on the available information. Consequently, the profile is limited to the confirmed facts of the actor’s alias, sector focus, financially motivated activity as demonstrated by the Edmodo data sale, and the singularly referenced campaign without further elaboration on methods or affiliations.

Incidents

Attributed incidents are available to members.