Elijah

Attacker attribution, primary-source threat intelligence, victim notification

Elijah is a pseudonym. The work is hacktivist by orientation, defender by trade — a one-person reverse SOC that runs attribution against criminal infrastructure until the people behind it have real names and the corporate fronts they registered attached. The byline names operators by the domains they actually used, not by invented designators or vendor tracking IDs. Where the evidence runs cold, the byline says so. Where it runs to a Telegram bot, a shell company, or a Ho Chi Minh City office on a named ISP subscriber range, the byline carries that to the reader with the chain of artifacts intact. The other half of the work is the part nobody funds: notifying the victims. Every operator that gets named ships with a privacy-preserving lookup so a stolen-credentials list can confirm exposure without exposing it further. No proof-of-concept code, and no indicators at IOC-grade specificity while the operators are still moving — defenders get the playbook, criminals get the spotlight. Identifying details about the writer are withheld for the reasons obvious to anyone who has watched an attribution writer get doxxed for landing the punch. The work arrives with operator names attached. That is the credential.