FastAttacker1877
FastAttacker1877 is a persona operating a Telegram channel and Tor site for publishing, selling and promoting allegedly stolen databases. The actor mixes financially motivated sales with anti-regime messaging, including a claimed RDP brute-force operation against Iran's Basij and subsequent sale of the allegedly collected data.
The profile combines explicit technical claims, politically framed targeting and commercial data sales. The actor's strongest direct technical statement is the use of RDP brute force in the alleged Basij operation.
The shift from 500,000 files in the operation narrative to 500,000 lines in the sales post creates a material inconsistency in the described volume and unit.
INFERENCE (confidence: high): financial monetization is a primary motive even when the initial target is selected through anti-regime or retaliatory reasoning.
INFERENCE (confidence: medium-high): the Tor site is intended to reduce dependence on Telegram and provide a more persistent sales layer after prior channel deletion.
ATT&CK
MITRE ATT&CK
Research