GorgorTideX

GorgorTideX is a Telegram-centered group identity that publicly promotes recruitment, technical capability, and a purported 64-bit implant branded “DEATH SHELL.” Its channel also amplifies datasets and claims originating from other actors.

The strongest evidence concerns organizational intent: the group seeks advanced web hackers and malware developers, uses a public contact path, and directs product interest through a Telegram bot. These activities are consistent with an effort to build or market a cyber capability.

The technical specifications attributed to DEATH SHELL—including indirect syscalls, encrypted communications, and endpoint-defense bypass—are self-asserted. No sample, hash, C2 endpoint, packet capture, or independent reverse engineering was identified.

Overall confidence is Medium for identity continuity, recruitment, and product marketing; Low–Medium for actual malware development capability; and Low for direct responsibility for victims appearing in reposted data-leak content.