IntelBroker

IntelBroker is a black hat hacker who has committed several high-profile cyber attacks against large corporations and government agencies, with over 80 sales and leaks of compromised data having been traced to them. IntelBroker first began activities in October 2021, hacking minor organizations, but gained notoriety in 2023 after an attack on the food delivery service "Weee!". They have been active on BreachForums, an online cybercrime forum, serving as its owner between August 2024 and January 2025. In February 2025, a United Kingdom national was arrested in France, and was named as IntelBroker in an indictment and press release by the United States District Court for the Southern District of New York.

IntelBroker is a black hat hacker who has committed several high-profile cyber attacks against large corporations and government agencies, with over 80 sales and leaks of compromised data having been traced to them. IntelBroker first began activities in October 2021, hacking minor organizations, but gained notoriety in 2023 after an attack on the food delivery service "Weee!". They have been active on BreachForums, an online cybercrime forum, serving as its owner between August 2024 and January 2025. In February 2025, a United Kingdom national was arrested in France, and was named as IntelBroker in an indictment and press release by the United States District Court for the Southern District of New York.

Personal details

After their initial string of attacks, IntelBroker was speculated to be a highly skilled team, possibly an Iranian Persistent Threat Group; however, an interview with The Cyber Express revealed that they were a single person. In another interview with the German podcast Inside Darknet, IntelBroker claimed that he was Serbian and resided in Russia for safety reasons. IntelBroker has expressed that law enforcement assigns national affiliations to independent actors too quickly and that the media often cover or overlook cyberattacks selectively. In their interview with Inside Darknet, IntelBroker expressed a desire to one day manage a cybercrime forum. They told The Cyber Express that one of their hobbies is drinking and that "exploiting digital vulnerabilities" can be lucrative "all while operating within ethical and legal boundaries".

Ransomware

IntelBroker created a unique ransomware strain written in C# known as Endurance, and published its source code publicly on his GitHub page. While labeled as ransomware, the software overwrites and then deletes all targeted files. Endurance was confirmed by the Department of Defense Cyber Crime Center (DC3) to have been used by IntelBroker to hack several U.S. government agencies. They speculated that Endurance was related to the Shamoon wiping software sometimes used by Iranian Hackers, which IntelBroker has denied. After 2023 IntelBroker no longer appears to be engaged in ransomware activities.

Reported attacks

As of June 2024, IntelBroker had posted over 80 separate leaks and sales of compromised information on BreachForums and claimed that they had sold the information of over 400 organizations. Most of their targets are U.S.-based. IntelBroker infiltrated a database containing 2.5 million records and 1.9 million emails via the Los Angeles International Airport's customer relationship management system. They also accessed data from the U.S. Immigration and Customs Enforcement and the United States Citizenship and Immigration Services, including information of more than 100,000 U.S. citizens. Other targets of IntelBroker included Hewlett Packard Enterprise, Verizon, HSBC, Accor, Home Depot, Facebook, Tech in Asia, and various U.S. government agencies. In early 2023, IntelBroker infiltrated the U.S.-based grocery chain Weee! and exposed the personal information of more than one million delivery order customers, including names, phone numbers, email addresses, and building entry codes, but not financial and payment data according to the company. In March of the same year, they breached DC Health Link, an American health insurance marketplace, and exposed the contact information and Social Security numbers of some members of the United States Congress. In December 2023, IntelBroker claimed to have obtained sensitive information about communications between the Pentagon and the United States Army's Chief information officer (CIO) and Deputy Chief of Staff (DCS/G-6 at the time). In May 2024, IntelBroker claimed that they had compromised employee information, FOUO source code, and operational guidelines of Europol and had breached the computer networks of Zscaler. In June they claimed to have extracted data such as client names and policy numbers from IT company Cognizant. In November 2023, IntelBroker and EnergyWeaponUser reportedly breached a third-party contractor for Nokia, but the company denied that its system or data had been compromised.

Acuity

In April 2024, IntelBroker announced that they and the black hat hacker Sanggiero had hacked Acuity, a technology contractor for the U.S. government, and subsequently obtained confidential information belonging to the Five Eyes intelligence organization and the United States military. A vast majority of the information had been stored in a GitHub repository by Acuity, which IntelBroker was able to access. The information included confidential communications and documents between Five Eyes members, and the contact information for several U.S. government and military officials. Sanggiero claimed that the breach had taken place on March 7, a month before the information was leaked. After an investigation, Acuity determined that the leaked data was old and non-sensitive.

Pandabuy

On March 31, 2024, IntelBroker assisted Sangierro in a hack of the Chinese e-commerce website Pandabuy, with user data sold on BreachForums for a small "symbolic" bitcoin payment. The information had been initially ransomed to Pandabuy for an unknown amount of money, but after it was paid, the leak was still released. IntelBroker and Sangierro claimed that the leak contained the names, contact details, orders, and addresses of over 3 million Pandabuy customers, while an analysis by "Have I Been Pwned?" creator Troy Hunt found that only approximately 1.3 million user entries were real, while the rest contained fake email addresses. Pandabuy attempted to censor posts on its Discord and Reddit pages to cover up the leak, before offering a "10% freight subsidy" to users as compensation. Both actions were received negatively by Pandabuy customers. On June 3, 2024, Sanggiero posted on BreachForums that they were going to sell all information from the data breach, containing over 17 million user entries, for $40,000. They had again ransomed the information to Pandabuy, who refused to pay as the two had violated the original ransom and sold the information.

Europol

On May 10, 2024, IntelBroker announced on BreachForums that they had gained access to 9,128 confidential records from the European Union's law enforcement agency Europol, including employee information, source code, and guideline documents. Most of the records came from the Europol Platform for Experts, a discussion platform for law enforcement, and the electronic evidence program SIRIUS. Europol confirmed that the leak was real, but claimed that it only contained information from Europol Platform for Experts and SIRIUS, and did not contain any operational information. IntelBroker announced that they would be accepting offers for the data in Monero, which was sold on May 11.

Apple

In June 2024, IntelBroker claimed on X that they had acquired source code for several internal Apple tools, including AppleConnect-SSO, Apple-HWE-Confluence-Advanced, AppleMacroPlugin, before releasing the code on BreachForums. These tools were related to internal Apple processes, such as authenticating users and sharing information within Apple's network. Later analysis revealed that leaked code was not source code, but instead plugins for internal tools. However, the code still was a security risk, and could potentially be used by malicious parties.

AMD

On June 17, 2024, IntelBroker claimed on BreachForums that they had breached semiconductor giant AMD, and were selling the compromised data. Samples provided by them included data on future products, employee information, customer information, source code, and financial records. AMD quickly contacted law enforcement agencies to investigate the breach. Soon after, AMD claimed that the breach was limited in scope, would not impact the business, and implied that it did not include employee or customer information, conflicting with the initial report by The Cyber Express. Bloomberg correlated the attack with a 2.4% fall in AMD stock soon after the breach was announced.

References

Text derived from https://en.wikipedia.org/w/index.php?oldid=1377264140 under CC BY-SA 4.0; modifications have been made.