/// ACCESS GRANTED /// Pompompurin TTP

/// CORE METADATA

PRIMARY ROLE: Data Seller / BreachForums Owner

STATUS: ACTIVE / HIGH THREAT

MOTIVATION: Fame/Financial

TARGETS: Technology, US Government (FBI), Data Aggregators

USERNAMES: Pompompurin (Arrested in 2023)

/// DATASET: MOST POPULAR BREACHES & SALES LOG (3 records)

[FBI LEEP System] Nov 2021 | Data: Sent 100,000 fake warning emails.. Context: Exploited a flaw (CVE-2021-40439) in an FBI contractor's email system..

[BreachForums] 2022-2023 | Data: Operated as owner/admin.. Context: Primary platform for data theft and sale during its operational period..

[Robinhood] 2021 | Data: Stole 5 million email addresses.. Context: Data listed for sale/public release..

/// TTP MAPPING: MITRE ATT&CK FRAMEWORK

Tactic	MITRE ID	Technique Description	Defense Focus
[Initial Access]	T1059.003	Command/Scripting Interpreter: Exploited vulnerabilities (e.g., CVE-2021-40439) in email service providers to send spoofed emails.	Email Anti-Spoofing, Outbound Email Monitoring
[Execution]	T1203	Exploitation for Client Execution: Exploited the FBI's Law Enforcement Enterprise Portal (LEEP) to send tens of thousands of fake cyber-attack warnings.	Vulnerability Management for Public-Facing Systems
[Collection]	T1580	Stolen Data Sale: Sold databases and access credentials on the BreachForums platform (Owned by the actor).	Forum Monitoring, Account Vetting

/// WEAPONIZATION: KEY TOOLS & ARTIFACTS

Spoofed Email Scripts [Email/Social Engineering] Vulnerability Exploits [Initial Access] Dark Web Forum Infrastructure [Market Platform]