GO TO DOXBIN.COM FOR THE FULL PASTE: _.-"\ _.-" \ ,-" \ ( \ doxbin \ \ \ \ \ \ story \ \ \ _.-; \ \ _.-" : \ \,-" | _-" \( | _.-" -@lilbeamed cv `--" 8888b. dP"Yb Yb dP 88""Yb 88 88b 88 88""Yb 888888 88""Yb dP"Yb 88""Yb 888888 888888 88""Yb 8I Yb dP Yb YbdP 88__dP 88 88Yb88 88__dP 88__ 88__dP dP Yb 88__dP 88 88__ 88__dP 8I dY Yb dP dPYb 88""Yb 88 88 Y88 88"Yb 88"" 88""" Yb dP 88"Yb 88 88"" 88"Yb 8888Y" YbodP dP Yb 88oodP 88 88 Y8 88 Yb 888888 88 YbodP 88 Yb 88 888888 88 Yb ┌──────────────────────────────────────────────────────────────────────────────┐ │ TABLE OF CONTENTS │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ---- 01. STORY & BACKGROUND │ │ ---- 02. TARGET IDENTIFICATION │ │ ---- 03. FAMILY & ASSOCIATES │ │ ---- 04. CONTACT VECTORS │ │ ---- 05. BREACH INTELLIGENCE / THE "CRACKER" IDENTITY │ │ ---- 06. TECHNICAL INFRASTRUCTURE │ │ ---- 07. PROFESSIONAL HISTORY │ │ ---- 08. NOTABLE OPERATIONS (DOXBIN, LAPSUS$, SIEGECULTURE) │ │ ---- 09. PASSWORD ANALYSIS (WTF IS THIS SHIT) │ │ ---- 10. OPERATIONAL NOTES │ │ ---- 11. FINAL MESSAGE │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ STORY & BACKGROUND ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ Brian Krebs. This self-righteous son of a bitch who thinks he's the │ │ guardian of the internet. The man who "exposed" Doxbin, who wrote about │ │ KT/Kayte like he's some kind of hero, who leaks private chats and calls │ │ it journalism. │ │ │ │ Let me tell you something about Doxbin and the current administration. │ │ I respect maybe 3 admins there - the rest are garbage, just like the │ │ entire community. LARPing skids, ego-boosted children, and fed collaborators │ │ But Krebs? He's the worst kind of hypocrite. │ │ │ │ This bastard dared to talk about Doxbin, about harassment, about swatting, │ │ while sitting in his little Alabama bubble. He wrote hit pieces about │ │ "cybercriminals" while his own security was a fucking joke. The man who │ │ reports on data breaches had his entire digital life exposed in 2,844 │ │ different breaches. The irony is so thick you could cut it with a knife. │ │ │ │ To the FBI: Your favorite pet journalist is compromised. How does it feel │ │ knowing your "cybersecurity expert" uses passwords like "nigger" and │ │ password1"? You give him awards while his OPSEC is worse than a 12-year-old │ │ on TikTok. │ │ │ │ Brian Krebs thought he could talk about Doxbin, about WhiteDoxbin, about │ │ SiegeCulture, and face no consequences. He thought leaking LAPSUS$ chats │ │ made him a hero. It made him a target. │ │ │ │ The hunter becomes the hunted. Welcome to the bin, Brian. │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ TARGET IDENTIFICATION ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ LEGAL NAME: Brian Christopher Krebs │ │ ├─ ALIASES: briankrebs, crack3d, cr@k3r, visormiser, GM3, ruskiman1 │ │ ├─ DOB: 1972 (Age 53-54) │ │ ├─ POB: Alabama, United States │ │ ├─ OCCUPATION: Professional Snitch / Fake Cybersecurity Expert │ │ ├─ CURRENT LOCATION: Mount Olive, AL │ │ ├─ PREVIOUS LOCATIONS: │ │ │ ├─ Alabaster, AL │ │ │ ├─ Birmingham, AL │ │ │ ├─ Gardendale, AL │ │ │ ├─ Springfield, VA (Childhood - Delivering WaPo) │ │ │ └─ Arlington, VA (Washington Post years) │ │ ├─ EDUCATION: George Mason University (B.A. International Relations, 1994) │ │ └─ STATUS: Fully Compromised / Burned Asset │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ FAMILY & ASSOCIATES ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ SPOUSE ────────────────────────────────────────────────────────────────┐ │ │ │ Name: Elizabeth Marie Krebs │ │ │ │ Age: 53 │ │ │ │ Location: Mount Olive, AL / Birmingham, AL │ │ │ │ Relatives: Brian Krebs, Frances Maluff, Louis Maluff │ │ │ │ Status: Married to the biggest snitch in cybersecurity │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ RELATIVES ─────────────────────────────────────────────────────────────┐ │ │ │ Frances Maluff │ │ │ │ Louis Maluff │ │ │ │ Patrick Finlen │ │ │ │ Carol Finlen │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ CHILDHOOD ─────────────────────────────────────────────────────────────┐ │ │ │ At age 9, helped older brothers deliver The Washington Post in │ │ │ │ Springfield, VA neighborhood. Started as a paperboy, ended as │ │ │ │ a professional informant. Full circle. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ CONTACT VECTORS ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ PRIMARY EMAIL (THE "CRACKER" ACCOUNT) ─────────────────────────────────┐ │ │ │ cracker@gmail.com (PRIMARY - Used across 2,844+ breaches) │ │ │ │ cracker@gmail.com16863324 (Variant with numbers) │ │ │ │ admin@krebsonsecurity.com (Professional) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ PHONE NUMBERS ───────────────────────────────────────────────────────── │ │ │ PRIMARY: (205) 960-**** (Alabama - Partially masked) │ │ │ │ EXPOSED: 678-578-3218 │ │ │ │ 269-585-4588 │ │ │ │ 703-989-0727 (Virginia - Old number) │ │ │ │ 703-256-0580 (Virginia - Annandale) │ │ │ │ INTERNATIONAL: 09788423248 / 09788423277 │ │ │ │ ADDITIONAL: 33694786763, 1552154994, 1547003922, 73794557392, │ │ │ │ 6578573844684, 74626346517, 5243475534757 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ PHYSICAL ADDRESSES ────────────────────────────────────────────────────┐ │ │ │ CURRENT: ***** Sutherland Rd, Mount Olive, AL │ │ │ │ PREVIOUS: Alabaster, AL │ │ │ │ Birmingham, AL │ │ │ │ Gardendale, AL │ │ │ │ MGM RESORTS (Travel): Warrenton VA US 20186 │ │ │ │ ALT: Annandale VA US 22003 (Birthdate 1972/05/09 in records) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ SOCIAL MEDIA ──────────────────────────────────────────────────────────┐ │ │ │ X/TWITTER: @briankrebs (Created: Wed Mar 04 15:57:39 +0000 2009) │ │ │ │ MASTODON: @briankrebs@infosec.exchange │ │ │ │ LINKEDIN: linkedin.com/in/bkrebs │ │ │ │ SIGNAL: briankrebs.07 │ │ │ │ DUOLINGO: ruskiman1 (Learning Russian - ID: 34792404) │ │ │ │ HACKFORUMS: crack3d (UID: 523756, Reg: 2010-10-23) │ │ │ │ RAIDFORUMS: crack3d (UID: 121383729) │ │ │ │ OGUSERS: GM3 (Multiple breaches) │ │ │ │ LIVEJOURNAL: briankrebs (Password: L1v3J0urn2l1) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ BREACH INTELLIGENCE / THE "CRACKER" IDENTITY ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ Brian Krebs uses "cracker@gmail.com" as his primary email across THOUSANDS │ │ of services. The irony of a "cybersecurity expert" using "cracker" as his │ │ identity is lost on no one. This is the digital equivalent of leaving your │ │ front door open with a sign saying "rob me." │ │ │ │ ┌─ KREBSONSECURITY.COM LOGIN ─────────────────────────────────────────────┐ │ │ │ Username: briankrebs │ │ │ │ Email: admin@krebsonsecurity.com │ │ │ │ Hash: bcrypt$2a$12$xJsZGtRMmCnsPGR/4luFR.LkMn6vT3p6fVc8Vt2JCT... │ │ │ │ ...tJnTmsRdHh.$2014-01-06 │ │ │ │ Algorithm: Bcrypt (Cost Factor 12) │ │ │ │ Cracked: Probably "L1v3J0urn2l1" based on LiveJournal leak │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ HACKFORUMS.NET ────────────────────────────────────────────────────────┐ │ │ │ Username: crack3d │ │ │ │ Email: cracker@gmail.com │ │ │ │ Hash: 73b913f138ece2e9254a70b3cd21d0e4 (MD5) │ │ │ │ Salt: ch91h87A │ │ │ │ Reg IP: 216.55.165.219 │ │ │ │ Last IP: 95.168.210.229 │ │ │ │ Reg Date: 2010-10-23 06:36:55 │ │ │ │ Last Active: 2011-02-02 21:34:26 │ │ │ │ Online Time: 2018 │ │ │ │ DOB: 1972-01-01 (Filed) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ RAIDFORUMS.COM ────────────────────────────────────────────────────────┐ │ │ │ Username: crack3d │ │ │ │ Email: cracker@gmail.com │ │ │ │ Hash: def5020052d700cf8b8fdf36c648aa68647a622a5a80de8107d25c... │ │ │ │ Salt: n4ZqDE5m │ │ │ │ UID: 121383729 │ │ │ │ Created: 1507397233 (Unix) │ │ │ │ Birthdate: 1972-01-01 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OGUSERS.COM ───────────────────────────────────────────────────────────┐ │ │ │ Username: GM3 │ │ │ │ Email: cracker@gmail.com │ │ │ │ Hash: $argon2id$v=19$m=65536,t=4,p=1$djdLSVp3ZDRBaWZaZnY5Vg... │ │ │ │ Salt: mZobjhpQ │ │ │ │ IP: 185.213.154.162 │ │ │ │ UID: 58063 │ │ │ │ Created: 1528734370 │ │ │ │ Birthdate: 1971-05-01 (Inconsistent with other records) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ TWITTER (2021 BREACH) ─────────────────────────────────────────────────┐ │ │ │ Username: briankrebs │ │ │ │ Email: cracker@gmail.com │ │ │ │ Name: briankrebs │ │ │ │ Created: Wed Mar 04 15:57:39 +0000 2009 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ LIVEJOURNAL ───────────────────────────────────────────────────────────┐ │ │ │ Username: briankrebs │ │ │ │ Email: cracker@gmail.com │ │ │ │ Password: L1v3J0urn2l1 (PLAIN TEXT - WTF) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ FLIPD.GG ─────────────────────────────────────────────────────────────┐ │ │ │ Username: GM3 │ │ │ │ Email: cracker@gmail.com │ │ │ │ Hash: $argon2id$v=19$m=65536,t=4,p=1$djdLSVp3ZDRBaWZaZnY5Vg.. │ │ │ │ Salt: mZobjhpQ │ │ │ │ IP: 185.213.154.162 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ CRACKED.TO ────────────────────────────────────────────────────────────┐ │ │ │ Username: cracker eg │ │ │ │ Email: cracker@gmail.com │ │ │ │ Hash: $2y$12$GGmdHuRo7cTfjjTGDUMcbeE2oCRQrZZvDjFIcPyDhmvVQh/... │ │ │ │ Salt: HlLeOZmt │ │ │ │ IP: 154.238.50.248 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ MGM RESORTS (TRAVEL DATA) ─────────────────────────────────────────────┐ │ │ │ Name: Brian Krebs │ │ │ │ Email: cracker@gmail.com │ │ │ │ Phone: 703-989-0727 / 703-256-0580 │ │ │ │ Address: Warrenton VA US 20186 / Annandale VA US 22003 │ │ │ │ Birthdate: 1972/05/09 (EXACT DOB CONFIRMED) │ │ │ │ Other: 31303711 (Internal ID) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ VERIFICATIONS.IO (MARKETING)───────────────────────────────────────────┐ │ │ │ Email: cracker@gmail.com │ │ │ │ IP: 139.37.230.186 │ │ │ │ Name: Karlie Davis (Alias/False Identity?) │ │ │ │ City: Rockford, IL │ │ │ │ State: IL │ │ │ │ Zip: 61103 │ │ │ │ Gender: male │ │ │ │ Website: coolsavings.com │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ ROCKETTEXT.COM ────────────────────────────────────────────────────────┐ │ │ │ Email: cracker@gmail.com │ │ │ │ Name: rell salim / Ryan Hi (Aliases) │ │ │ │ Phone: 678-578-3218 / 269-585-4588 │ │ │ │ Address: Hood Avenue, Chamblee, GA 30341 │ │ │ │ Alt: 200 university ave, Bassett, WI 53101 │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ DUOLINGO (LANGUAGE APP) ───────────────────────────────────────────────┐ │ │ │ Email: cracker@gmail.com / Cracker@gmail.com │ │ │ │ Username: ruskiman1 (Learning Russian - Suspicious?) │ │ │ │ ID: 34792404 │ │ │ │ Country: US │ │ │ │ Courses: Russian (1968 XP, 44 crowns), English (139 XP, 3 crowns) │ │ │ │ Total XP: 2107 │ │ │ │ Plus: True (Paid subscriber) │ │ │ │ Created: 1402246528 (Unix) │ │ │ │ Status: INELIGIBLE for beta │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ 2,844 ADDITIONAL BREACHES ─────────────────────────────────────────────┐ │ │ │ Adobe, Animoto, AntiPublic, Aptoide, Ashley Madison, bit.ly, │ │ │ │ Blank Media Games, Collection #1-5, CrackingForum, Deezer, Disqus, │ │ │ │ Dropbox, Dubsmash, Edmodo, Exploit.in, GoGames, JoyGames, Last.FM, │ │ │ │ Leet.cc, Lifeboat, MathWay, MyHeritage, MySpace, Neopets, Overblog, │ │ │ │ Pemiblanc, PhoneHouse.es, Poshmark, ShareThis, ToonDoo, Tumblr, │ │ │ │ Verified.cm, Wanelo, Wishbone, XSS.is, Zoosk, Zynga... │ │ │ │ │ │ │ │ This man has been in more breaches than he has written articles about. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ PASSWORD ANALYSIS - WTF IS THIS SHIT NGA ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ Brian Krebs, the "cybersecurity expert," uses the following passwords: │ │ │ │ PLAIN TEXT PASSWORDS FOUND: │ │ │ │ • L1v3J0urn2l1 (LiveJournal - his "professional" password) │ │ • nigger (Yes, really. Multiple breaches.) │ │ • password1 (The classic) │ │ • 12345678 / 123456789 / 1234567812345 (Counting is hard) │ │ • password / password123 / Password1! (Variations on a theme) │ │ • 1qaz2wsx (Keyboard walk) │ │ • 246810 (Even numbers, how clever) │ │ • steelers7 / Steelers78 (Sports team + number) │ │ • yankees (Another sports team) │ │ • J5Ukqtd$hB4rpuxj (Generated? But reused across Dropbox) │ │ • J5UkqtdhB4rpuxj! (Variant) │ │ • jennifer14 (Probably his wife/girlfriend's name + year) │ │ • emily.nudge / Emily.nudgE$ / Emily.nudgE. / Emily.nudgE@ (Emily who?) │ │ • Anja4lick / Anja4lick$ (Classy) │ │ • darklotus1 (Edgy) │ │ • blackbird / blackbird! (Spy movie fan?) │ │ • tigers123 / tigereyes73 (Animal themes) │ │ • Nosferatus.teppes / Nosferatus.teppes! (Vampire LARPer) │ │ • ghjanjg4 / Ghjanjg41 (Random garbage) │ │ • mgdeslauriers (French? Quebec connection?) │ │ • claytonauwema │ │ • redimith │ │ • goldfish │ │ • happeninga / happeningq / happeningqQ / happening1 / gnineppah (Reverse) │ │ • shitbag (Self-aware?) │ │ • urmomsass6 (Mature) │ │ • mcso1234 │ │ • Peaches │ │ • directx │ │ • Fraujaeger1 (German?) │ │ • Crackers1 / Crackers10 / cracker9999 / Crackill! / Crackill123 │ │ • ackbird (Typo?) │ │ • gizmodog1 (Gizmodo fan?) │ │ • choice │ │ • kwood │ │ • fugazi │ │ • HidHo1123 / HidHo1. / HidHo1* (Hide ho? Prostitution reference?) │ │ • 123happening │ │ • ch3ss │ │ • Crazy007 │ │ • 1avalon (Avalon Hill games?) │ │ • lol7842324 │ │ • fi9reewalll (Firewall with 9 and 3 L's... "secure") │ │ • viva11 │ │ • 12345678q123 │ │ • helpskills44 │ │ • crackface / cracker257 / crackerb / cracker4718 / cracker9897 │ │ • pissoff │ │ • x___rhii │ │ • damore23 │ │ • Password21 │ │ • super │ │ • virgini │ │ • 11111 │ │ • tristian111 / tristian11 │ │ • tracker01 │ │ • 891949 │ │ • n30p3ts1 │ │ • duane │ │ • cheap │ │ • crackers │ │ • access │ │ • tequiero │ │ • baby31 │ │ • card │ │ • assman613 │ │ • Potter1 / Potter11 (Harry Potter fan) │ │ • libralady55 │ │ • doodles360 │ │ • 476293 │ │ • normandy │ │ • Society │ │ • donkey │ │ • chewie │ │ • byjacker │ │ • buckled69 / buckled! │ │ • 123abc │ │ • 37works │ │ • trout756 │ │ • kmd353533 │ │ • java2624 │ │ • sister │ │ • kenneth3 │ │ • gx5939269 │ │ • 4333724342220o │ │ • 110363 │ │ • J5Ukqtd123 │ │ • dewijones26! │ │ • botany1 │ │ • devilcriers │ │ │ │ AND THE BEST ONES: │ │ │ │ • allahis1 (Religious?) │ │ • rekcarC (Cracker backwards - so clever) │ │ • 216.55.165.219 (His own IP address as password) │ │ │ │ ANALYSIS: This is the password hygiene of a "cybersecurity expert"? │ │ My grandmother has better OPSEC. This man lectures others about security │ │ while using "password1" and racial slurs as passwords. The hypocrisy is │ │ astronomical. │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ TECHNICAL INFRASTRUCTURE ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ IP ADDRESSES & COORDINATES ────────────────────────────────────────────┐ │ │ │ │ │ │ │ IP: 96.41.191.221 │ │ │ │ ISP: Spectrum │ │ │ │ ASN: ASAS20115 │ │ │ │ Location: Medford, Oregon │ │ │ │ Coordinates: 42°20'21.8"N 122°50'51.0"W │ │ │ │ Plus Code: 85Q2+QX9 Medford, Oregon │ │ │ │ │ │ │ │ IP: 174.129.168.228 │ │ │ │ Location: Ashburn, Virginia (AWS EC2 us-east-1) │ │ │ │ ASN: ASAS14618 │ │ │ │ Coordinates: 39°02'37.4"N 77°29'15.0"W │ │ │ │ Plus Code: 2GV7+F2J Ashburn, Virginia │ │ │ │ Note: AWS hosting - hiding behind cloud infrastructure │ │ │ │ │ │ │ │ IP: 76.12.194.101 │ │ │ │ Location: Chicago, Illinois │ │ │ │ ISP: Ntirety, Inc │ │ │ │ ASN: ASAS20021 │ │ │ │ Coordinates: 41°52'57.4"N 87°38'14.6"W │ │ │ │ │ │ │ │ Registration IP: 216.55.165.219 (HackForums) │ │ │ │ Last IP: 95.168.210.229 (HackForums) │ │ │ │ Alt IP: 62.141.48.177 (Verified.cm) │ │ │ │ Alt IP: 190.148.78.239 (Aptoide) │ │ │ │ Alt IP: 93.108.39.27 (Leet.cc) │ │ │ │ Alt IP: 68.230.185.236 (Neopets) │ │ │ │ Alt IP: 81.217.208.39 (ToonDoo) │ │ │ │ Alt IP: 185.213.154.162 (OGUsers/Flipd) │ │ │ │ Alt IP: 14.174.81.165 (JoyGames - Vietnam?) │ │ │ │ Alt IP: 154.238.50.248 (Cracked.to) │ │ │ │ Alt IP: 139.37.230.186 (Verifications.io) │ │ │ │ Alt IP: 5.44.170.163 (VimeWorld) │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ COOKIE INVENTORY ──────────────────────────────────────────────────────┐ │ │ │ Total: 1156 cookies across 315 domains (47 usable) │ │ │ │ │ │ │ │ Notable Domains: │ │ │ │ • grammarly.com (18 cookies, 3 usable) │ │ │ │ • atlassian.com (15 cookies, 3 usable) │ │ │ │ • yandex.ru (4 cookies - Russian services?) │ │ │ │ • digitalocean.com (12 cookies - Infrastructure) │ │ │ │ • dev.coursia.ai (Credentials: cracker@gmail.com / password) │ │ │ │ │ │ │ │ Google Account: AFx_qI7I8eOmYbyBfG-IHfI84EYuj93Zf-zprJ9 │ │ │ │ │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ PROFESSIONAL HISTORY ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ THE WASHINGTON POST (1995-2009─────────────────────────────────────────┐ │ │ │ Started: Circulation department (paperboy basically) │ │ │ │ Promoted: Copy aide (sorting mail, taking dictation) │ │ │ │ Then: Editorial aide, financial desk │ │ │ │ 1999: Staff writer for Newsbytes.com (WaPo owned) │ │ │ │ 2002: Washingtonpost.com staff writer │ │ │ │ 2005: Launched "Security Fix" blog │ │ │ │ 2009: Left to launch KrebsOnSecurity.com │ │ │ │ │ │ │ │ Started as a paperboy, ended as a professional snitch. Full circle. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ KREBSONSECURITY.COM (2009-PRESENT)─────────────────────────────────────┐ │ │ │ Focus: Cybercrime investigation, doxing, exposing "criminals" │ │ │ Method: Leak private chats, publish personal info, collaborate with FBI │ │ │ │ Funding: Probably fed contracts and Cisco awards (see below) │ │ │ │ Security: Compromised in 2,844+ breaches │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ AWARDS (FED PAT ON THE HEAD) ──────────────────────────────────────────┐ │ │ │ 2004: Carnegie Mellon CyLab Cybersecurity Journalism Award │ │ │ │ 2005: CNET Top 100 Blogs (Security Fix) │ │ │ │ 2009: Cisco "Cyber Crime Hero" Award (Fed collaborator confirmed) │ │ │ │ 2010: Security Bloggers Network "Best Non-Technical Security Blog" │ │ │ │ 2010: SANS Institute Top Cybersecurity Journalist │ │ │ 2011: Security Bloggers Network "Blog That Best Represents the Industry" │ │ │ │ 2014: National Press Foundation "Chairman's Citation Award" │ │ │ │ 2017: ISSA President's Award For Public Service │ │ │ │ 2019: CISO MAG Cybersecurity Person of the Year │ │ │ │ │ │ │ │ Translation: Awards from the establishment for being a good boy. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ BOOKS ─────────────────────────────────────────────────────────────────┐ │ │ │ 2014: "Spam Nation: The Inside Story of Organized Cybercrime" │ │ │ │ Award: 2015 PROSE Award (More establishment praise) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────────────────────────────────────────────────────────────┐ │ [ NOTABLE OPERATIONS - THE HITS AND THE LEAKS ] │ ├──────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─ OPERATION: INTERCAGE/ATRIVO TAKEDOWN (August 2008) ────────────────────┐ │ │ │ Target: Intercage/Atrivo hosting provider │ │ │ │ Result: Disconnected from internet │ │ │ │ Method: Hit pieces in Washington Post │ │ │ │ Note: First major scalp. Started the "destroy hosting providers │ │ │ │ approach that would define his career. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: ESTDESTAINS DESTRUCTIO──────────────────────────────────────┐ │ │ │ Target: EstDomains registrar │ │ │ │ Result: ICANN revoked their charter │ │ │ │ Method: Exposed president's criminal record (Vladimir Tšaštšin) │ │ │ │ Note: Tšaštšin later arrested for DNS Changer Trojan operation │ │ │ │ (Krebs took credit) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: MCCOLO TAKEDOWN (November 2008) ────────────────────────────┐ │ │ │ Target: McColo hosting (botnet C&C hub) │ │ │ │ Result: Disconnected, 40-70% spam reduction worldwide │ │ │ │ Note: Legitimate success, but established pattern of destruction │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: STUXNET EXPOSURE (2010) ────────────────────────────────────┐ │ │ │ Claim: First journalist to report on Stuxnet malware │ │ │ │ Reality: Probably fed leak, taking credit for intel community work │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: TARGET BREACH (December 2013) ──────────────────────────────┐ │ │ │ Broke: Target Corporation 40M card breach │ │ │ │ Doxxed: Ukrainian card seller (6 days later) │ │ │ │ Price: $100 per card on black market │ │ │ │ Note: Fast turnaround - fed connections suspected │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: SWATTING VICTIM (March 14, 2013) ───────────────────────────┐ │ │ │ Status: One of first journalists swatted │ │ │ │ Irony: Writes about swatting dangers, gets swatted himself │ │ │ │ Result: Survivor's complex, more self-righteousness │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: MIRAI DDOS (2016) ──────────────────────────────────────────┐ │ │ │ Attack: Largest DDoS in history (at the time) using Mirai malware │ │ │ │ Reason: Retaliation for vDOS botnet investigation │ │ │ │ Result Akamai dropped him, Google Shield picked him up (fed backed?) │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: COINHIVE/PR0GRAMM (March 2018───────────────────────────────┐ │ │ │ Action: Published names of German imageboard pr0gramm admins │ │ │ │ Response: Users donated €200,000+ to cancer charities (Krebs = cancer │ │ │ │ in German) as protest │ │ │ │ Note: Even Germans hate him. That's saying something. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: DOXBIN EXPOSURE (2019-2022)─────────────────────────────────┐ │ │ │ 2019: Identified Doxbin maintainer as white supremacist linked │ │ │ │ to SiegeCulture │ │ │ │ 2022: Reported WhiteDoxbin (LAPSUS$ leader) purchased Doxbin │ │ │ │ Result: Targeted Doxbin community, made enemies of everyone │ │ │ │ Status: This is why he's being doxed now. Revenge is served cold. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ ┌─ OPERATION: LAPSUS$ CHAT LEAK (April 2022) ─────────────────────────────┐ │ │ │ Action: Leaked private chats of LAPSUS$ extortion group │ │ │ │ Content: Showed they stole T-Mobile source code │ │ │ │ Method: Probably fed source, presented as "investigative journalis │ │ │ │ Note: Leaking criminal chats is still leaking private comms. │ │ │ │ Glass houses, Brian. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ │ OPERATION: EWORLDTRADE/INTERSYS (May 2025)────────────────────────────────┐ │ │ │ Target: Texas eWorldTrade LLC, Pakistan Intersys Limited │ │ │ │ Accused: Opioid distribution, trademark scams, ghostwriting fraud │ │ │ │Result: Defamation lawsuit filed in Pakistan against KrebsOnSecurity │ │ │ │ Status: Getting sued for defamation. Karma. │ │ │ └─────────────────────────────────────────────────────────────────────────┘ │ │ │ └──────────────────────────────────────────────────────────────────────────────┘ .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... .......................................................................................................................................................... ........................................................................:::::;;::... .................................................................. ............................................................. .. ..... ........................................CV...................... .......................................................... .:;:. ... . ............................................................. ........................................................ . ..:::.. ..::::.:...... ........................................................... ...................................................... .:...........::::...... ..::...................................................... .................................................... . ........ ... ::...:.. :;;. .................................................. .................................................. ..... .... ..:. .. ................................................. ................................................ ......::....... . ... ................................................ ............................................... .. .:. ..::. :; ............................................... .............................................. ..... ..:. ............................................... ............................................. ..:. .. .. . :;: .............................................. ............................................ ...:. ... .::: .............................................. ............................................ .......... :. ............................................. ........................................... ... ..:. .:.. ............................................. .......................................... .. ............................................. .......................................... ... . .. ............................................. ......................................... ..... .......:. ............................................ ......................................... .. ...:::::::.:.. ............................................ ......................................... .. ..:.::::::::..:::. ............................................ ......................................... .... ... ... ..::::::::::.::...::::. ............................................ ......................................... .......:::::.. ..::::::::::::............. ............................................. .......................................... ..........:::::::::::::::;++;;;::::::::............ ............................................. ........CV.................................. ...........::::::;;;+++++;+;;:::::::::............. ............................................. ............................................ ...........::::::::;;++++++;;::::::::::..:......... .............................................. ............................................ ............::::::::::;+;;;;;;:::::::::::::.::...... .:............................................. ............................................. ...........:::::::::::;;;;;;+;;:;::::::::::::::..::... ................................................ .............................................. ..........::::::::::;;:;;;;;;;;;:::::::::::::::.:..... .::::............................................ ..........................................:;::: ..........:::::::::;;;;;++;;:;;;;;:::::::... ....:. :.;:............................................. ...........................................::.: ..... ...:::::::;;;;;;::::::::........ . ..::. :::.............................................. ...........................................::::. ...:...... . .....:::::::::::... ...::....:::. .:::.............................................. ............................................:::: ...:::.:..... ..::::::::.....:...... ...::::.. .;;....................:;......................... .............................................:;;....:::::...:+....+;;:::.::;;;:.::::;;;...:;:...:::::.. .::................:..;;x+;;:..................... ..............................................:: ..:::::::..::..:::;;;;:.:;+::::+;;;:::::::::::::::... .:..........:x++;;+:;::+;++++x:................... ...............................................:. ..:::::::::::::::::::::.:;;::.:::::::::::::::::::::+;.;:.::;;::::;;++:;;++:;;:+;;;+;:................... ...............................................:::...:::::::::::;;::;:::..::;;::;::;::;;+;;;+;+;;;;+;;+;;;+:;::;:x:;;++++:::. :..;+xX+;................... ................................................;;...:;;;::;;;;;;:;;:;;;+;;;+++;;;;;:+;;+;:;;:;++++++;+;+;:;;:+x+;;;++xx;::;.:x:.:+++x;;:................. ................................................:;:+;:;;:+++x;;:::::;+++++;;;;;;::::;;::+;+;+++;++;xxx+;;x;;+;;;;++;;;x;:;;;;...;+xx;+;;:................. .................................................:;+:;+:. ;+;:.;::...:+xxxxx++:;.:++++;.:;;:+;;;; ;;++;::::.;;+x;+;;;;;+;:++;;;.:;;:;:.................... ...............................................:;:: :;;:. ..;. ...:++;:+;:;;x++:+;+;+;. :;:x+;;;:...:;:;:+x++;+;++::+;:+:;:::................... ..........................................:::..:;;:::.:;:. ;.:. ..:;+++++;;++;:;;:;::::+;x:.;;.;;;+:+xx+x;;;;;:::;+::;;:;::+;.;+++:.................... .........................................:;:;++;;;;;;;;;:. ::; . ..:;;;:.. .;+;;+:;;++:;;;;.+;;+:;;.:;;;+;:;::;;;.............:;:........................ ..............................................+;;:::;::;+; ... .. .... +;+;:;.::;.:;:::;;;:... ::;::................................................ .............................................:;;;+::...;:;. . ;+;+;:;;;;::::::............................................................. ............................................:;:+::;.:;+;+;+ . :::...:.::;:::;+;;::::::............................................................. ...........................................::..:.:.:.x;.:+;;::.:+;... ..::::;::;;:;:;::::::::............................................................. ..........................................;;. ......;;;;;::;+;;::;:;;;;;;;;;.::;.:;:::::::............................................................. .........................................:::. .::;;:;;;++;;++;;+:;;:;;::;;+::;::;;;:::::::............................................................. :........................................:++;. ..::;++::::;;;;;;;:::;+++:..:+;.::::::..::::::....:........................................................ ..........................................;:;;+::::::::::::;;;;;::xxxx;:::::::;;++::.:::::::....:x; ...................................................... .........................................:;:;+;.::::::::::::::::::;xx;:.::;;::::;:.:::::::::...:+x+. ..................................................... ..........................................;:......:::::::::::::::::::::.;::::::.:::::::::::...;xxx+. .................................................... .............................................:::::::::::::::::::::.:;;:::::::::.;::::::::::..+xxxx; .................................................. :.....................................:::..:::::::.......:::..::::::::::::::::.::;;:::::::.:+:;xxx: ................................................ :....................................::::::::::::::::::;;;;;+::..::::.::::..:;;:;;::::::. .+xx .............................................. :...................................:::;;::::::::::::::;;+++;;+;;;;:;;+;+;:.::::::::::.. ;x: ........................................... ....................................:::::::::::::::::;;;;;+++;;+;;+:: ...::::::.... :+ ........................................ :...................................::::::::::::::::::::::::::;:;: ::. .: ..................................... :::................................:::::;;;;;;;;;;;;:::::;:;::.:: ................................ :::::....................... ..::::;;;;;;;;;;;;;;;;;;;;;::.::. .......................... ::::................... .:::::;;;;;;:;;;;;;;;;;;;:::..::.. CV .................... :::::............ ..:::::::::::::::::::::...:::::::.. ............. ::::..:.... .::.::;;:::::::::::::::::::::..::. +xxx: .... .::... .....::;;;;;;;;;;;:::::::::::::... ;xxxxx; .: .......::;;;;;;;;;;;;;;;::::::::... ;xxxxxxx; :;: .......::::::::::;;;;;;;::::::::..: :xxxxxxxxx: :+x;+ .........::;;::::::::::::::::::::..: .xxxxxxxxxxx: :x;;: . ......::::;::::::::::::::::....... ;xxxxxxxxxxxxx+ ;+ :+++;+: . ........:::::::::::::::::::::.:::. .+xxxxxxxxxxxxxxxx: .+;;++;.;;:.;+++::;. . .........:::::::;;;;::::::::::.::::::::;+xxxxxxxxxxxxxxxxxxx; ;+;::;+;+::::+++;xx+. ... ...........:::::::::::::::::::..:::.:+xxxxxxxxxx.:;xxxxxxxxxx: .:;+;;;;+x+::+++;;;;;. .:.. ............::::::::.....+;...::..:.:;+xxxxxxxxxxx.:xxxxxxxxx+ .;x;;;;.+x+;:+;+;::: ;+;. ...........:::::::::......:;;:+:;++:;::;xxxxxxxxxxxxxxxxxxxxxx: :+;.:;:;+++x+;;:.+; :++++:...........:::::::::::.:;;;:;;;;++;;;:: +xxxxxxxxxxxxxxxxxxxxx ;+:.:++;;:;:.::;; .;++xxx+::........:::::::::.::.::;;:;::::. .xxxxxxxxxxxxxxxxxxxx: :++;.::x++;: :++xxxxxxx;::.::..::::::::.:::. +xxxxxxxxxxxxxxxxxxx ..;+++: ;xxxxxxxxxx+:::::::::::::::::. :xxxxxxxxxxxxxxxxxx; .;+: .+xxxxxxxxxx+;:::::::::::::. +xxxxxxxxxxxxxxxxx. .xxxxxxxxxxxx;::::::::. :xxxxxxxxxxxxxxxx; :xxxxxxxxxxxx+::::::: .+xxxxxxxxxxxxxxx: .xxxxxxxxxxxxx;::::+; ;xxxxxxxxxxxxxx+. CV .xxxxxxxxxxxxx+::;xx. .xxxxxxxxxxxxxx; .xxxxxxxxxxxxxx:+xx; +xxxxxxxxxxxx+. .+xxxxxxxxxxxxx+xxx. :xxxxxxxxxxxx+ .+xxxxxxxxxx+xxxxx+ xxxxxxxxxxxx: ... +xxxxxxxxx++xxxxx; :xxxxxxxxxxx ;xxx+;. ;xxxxxxxxx++xxxxx: xxxxxxxxxx; ;xxxxxxxxx;. ;xxxxxxxxx+xxxxx+. ;xxxxxxxxx. +xxxxxxxxxxxxx;. ;xxxxxxxx++xxxxxx: xxxxxxxxx xxxxxxxxxxxxxxxxxx: ;x+: ;xx+xxxxxxx; +xxxxxxx; .+xxxxxxxxxxxxxxxxxxx: :. .+xxxxxxx;. :xxxxxxx. .+xxxxxxxxxxxxxxxxx++: .;:.. ;xxxxx+: .+x+;+x+ .xxxxxx+++;;;::.. .x$;x+ +xxxx+. ;; :.+: :.. +x: .xx+xx. +XXx+ :xxx; xXx.