Episode 4: A New Excel Sheet

Welcome to Memetic Warfare. We’ll start this week off with Episode 4 of the KittenBusters leaks. I’ll let KittenBusters introduce the new tranche themselves:

Firstly, great on whoever posted this for sharing it as a “unified infrastructure Excel sheet”. Leaked data is only useful if people read it, and they only look at it if it’s convenient to do so, and most importantly, ingest automatically even.

The first table is titled SERVICE and shows their rented infrastructure broken down by domain/hacktivist front - see Moses-Staff for example. What stands out to me beyond the leaked credentials are the emails themselves, which are great pivot points.

There’s more here also. We see the use of bulletproof hosts like The Onion Host for sites such as “israel-talent” and also information regarding anotherh acktivist front, Abraham’s Ax.

There’s really just a ton of interesting information here. We get servers and services broken down by category, including phishing, malware and so on. The phishing domains are of course highly indicative, targeting an organization named Arabian Aerospace as well as apparently the far left-wing (being polite here) think tank “Responsible Statecraft”.

We get more information on the use of bulletproof services like Stark Industries, and some legitimate ones like Namesilo, BlueVPS and so on.

But wait, there’s more. We get a list of crypto wallets:

Nariman Gharib has also downloaded a lot of the information, available here and structured into invoices. Shows how this top of operation can be run with a shoestring budget of 10,000 ish USD.

There’s a lot more here, and we have a ton of points to pivot off of, so I’m excited to see more.

The next item I want to bring up is a development regarding “Lashkar alTharallah”, a hacktivist group and apparent actual terrorist organization engaging in kinetic activity. We’ve covered them in the past here:

This same group has taken credit, as also discussed here, for the assassination of a Pakistani journalist who was known for his pro-normalization with Israel stance. Pakistan has apparently since confirmed this, saying that the person who order the assassination is in a “neighboring country”, clearly referring to Iran.

This is a super interesting (and unfortunate of course) situation. Here we have a group engaging in kinetic operations, directed from Iran, that also engages in IO itself - this is the type of thing we usually see from separate groups.

Also, this shows just how Iran views possible Pakistani normalization with Israel as being important enough to engage in an assassination in Pakistan to attempt to prevent it.