bRpsd

Profile narrative

bRpsd is a threat actor known by that alias, with a reported association to Albania. The actor has carried out a series of intrusions against dark web platforms that advertise hit‑for‑hire services and against at least one conventional website, autolet.it, where user credentials were exfiltrated in clear text. These actions have been documented in public reports and articles that describe the actor’s methods and the nature of the compromised targets.

The actor’s targeting focuses on illicit online services that claim to facilitate violent or criminal acts, specifically the Besa Mafia hit‑man site and similar dark web portals. In each case the actor gained initial access through SQL injection, extracted internal communications and login credentials, and then published the data on file‑sharing services such as Files.fm and Siph0n. The actor’s public statements accompanying the leaks directly accused the site operators of scamming users and criticized their poor security practices, indicating an objective of exposing alleged fraud and embarrassing the services rather than seeking financial profit or conducting espionage. No references to malware families, ransomware, or state‑backed tools appear in the available sources.

Attribution beyond the alias and the possible Albanian location is not established in the material; there is no indication of state sponsorship or membership in a larger criminal consortium. The most notable campaigns linked to bRpsd include the April 2016 breach of the Besa hit‑man portal, the June 2016 repeat intrusion of the same site, and the December 2015 dump of 2,716 user records from autolet.it. These incidents collectively illustrate a pattern of using SQL injection to compromise web applications, exfiltrating sensitive data, and leveraging public discreditation as a primary outcome of the operations.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 2 sources.