‘The Manipulaters’ Improve Phishing, Still Fail at Opsec

Published on:

April 3, 2024

The Resurgence of the “Manipulaters” Team - Breaking HeartSenders

In January 2024, The Manipulaters pleaded with Brian Krebs to unpublish previous stories about their work, claiming the group had turned over a new leaf and gone legitimate. But new research suggests that while they have improved the quality of their products and services, these nitwits still fail spectacularly at hiding their illegal activities.

https://krebsonsecurity.com/2024/04/the-manipulaters-improve-phishing-still-fail-at-opsec

Related Content

Research

MrHex: A New Hack and Leak Campaign Attributing Themselves to Handala

A network of online personas operating as MrHex has grown from a small stolen-data marketplace into an Iran-aligned hack-and-leak operation that openly calls Handala its “brothers.” Our analysis traces the group’s infrastructure from JokerData to mrhex[.]sbs, maps the roles of MrDarkRoot, Darku3er, and @Mr8ex, and assesses its September 2026 claims of attacks on US industrial facilities. Video evidence points to real access to at least one petroleum HMI, but the group’s claims of explosions and contamination remain unverified.

Learn More

Research

Spetsvuzavtomatika Leak Exposes an SVR Cyber Development Ecosystem

A darknet data leak from the Russian research institute Spetsvuzavtomatika (SVA) has exposed an extensive cyber development ecosystem serving Russia’s Foreign Intelligence Service (SVR). The leaked Git repositories, project specs, and technical reports reveal a sophisticated, modular research and development model focused on automating key phases of espionage—from cloud-agent command-and-control (Initiative-24) and automated target reconnaissance (Felix-23, HAD) to internal domain exploitation (Putnik) and anonymous infrastructure procurement (Chain-24).

Learn More

Research

Lemmings: Russian Industrialized Persona Provisioning and Management for Active Measures Campaigns

Leaked internal data from Russian contractor Okenit reveals "Lemmings" (Лемминги)—a Python-based framework designed to industrialize the creation, verification, and management of synthetic online personas for Russian active measures. Built to automate phone verification, email infrastructure, CAPTCHA solving, and anti-detection measures, Lemmings functions as the identity-provisioning layer within a larger ecosystem alongside proxy and tasking tools (SOI and SOS). Live tests against platforms like VK and Reddit demonstrate a shift toward scalable, modular software frameworks capable of maintaining durable cover identities for intelligence, influence, and disinformation operations.

Learn More