Your OPSEC Ain't Sh*t

By now the word has gotten out that the operator of BreachForums, pompompurin, has been arrested. It appears that BreachForums will continue to operate for now, and the new operator, Baphomet, has posted an update that includes, in part, this statement:

My only response to LE, or any media outlet is that I have no concerns for myself at the moment. OPSEC has been my focus from day one, and thankfully I don’t think any mountain lions will be attacking me in my little fishing boat.

I spent many years helping the government track down terrorists who also had an “OPSEC focus from day one” and their attempts at OPSEC were laughable and ultimately ineffective.

Ross Ulbricht thought he had good OPSEC as well, it turns out he didn’t. All it takes is one reused username, one slipped VPN connection or an exposed email address and the government will find you. And, that’s the thing, it is not just one government looking for you now, it is ALL the governments. Look at the number of governments involved in the HIVE takedown and the ChipMixer shutdown.

You see, most cybercriminals are used to trying to hide from security researchers, such as myself, and even then most of you do a piss poor job at that. But, when you attack hospitals, school kids, and national governments you get attention from those governments. The United States and other governments around the world have declared ransomware and other cybercrime a national security threat. Which gives law enforcement agencies access to new tools to go after these bad actors.

Law enforcement can be slower than we’d all like, but they are moving against ransomware and cybercriminal groups. If they can’t arrest you because you are in a non-extradition country they will come after your money and other assets and you better really like that non-extradition country because you aren’t leaving it.

Enjoy your “freedom” for now and make all the cocky posts you want on these forums, but know that all of the governments are targeting you, and know that your OPSEC ain’t shit when they decide to come for you.