| SYMBOL | COMMON_NAME | aka. SYNONYMS |
ModernStealer is linked to underground posts offering sensitive military, government, nuclear, and aerospace material, with connections to a Session contact identifier and a Telegram account named Sassoon Don. Analysts identified five ModernStealer listings and eight government-related listings, including references to Pakistan’s NUST and SUPARCO, as well as US defense entities. The shared identifier suggests operational overlap with other identities, but does not confirm a direct link between them. The actor exemplifies the importance of tracking durable identifiers over forum names in threat intelligence.
There are currently no families associated with this actor.
| 2026-07-31
⋅
StealthMole
⋅
The Many Faces of ModernStealer: Tracing an Underground Military Data Network ModernStealer |