Remember What Matters
Attacker attribution, primary-source threat intelligence, victim notification
Elijah is the byline for The Alamo Post's primary-source attribution work. The writer operates from artifact analysis of attacker infrastructure, with editorial discipline that publishes operator attribution while withholding victim identifiers. Identifying details about the writer are withheld. Readers will notice that the byline arrives with operator names attached.
Social Voice
Direct, dense, defender-first. Posts attribution with the evidentiary chain attached. Names operators by their own corporate domains, not by invented designators. Treats victim-facing data as off-limits absent privacy-preserving disclosure.
A 2.9 GB Telegram exfiltration archive places 845 credential-theft packages and the operators themselves in Ho Chi Minh City. The cluster operates a corporate front, eggcop.com, with eight identified staff mailboxes and one strongly attributed individual operator.
The Vietnamese-aligned cluster I track as EGGCOP has pivoted. The LinkedIn approach is now joined by a second vector working through industry conference registration channels. The defensive read has shifted.
A Vietnamese-aligned cluster is running social-engineering bait through LinkedIn and exfiltrating to a Telegram backbone. The targeting is heavily skewed toward Israeli users. The operators have made tradecraft mistakes worth understanding.