Threat reportThreat IntelligenceTL-2026-1836
ModernStealer: Cross-Platform Dark Web/Telegram Broker Network Claims Sale of Government and Defense Data
ModernStealer (TL-2026-1836) is a medium-severity tracked intrusion set, first published 2026-08-03. It is attributed to ModernStealer with medium confidence, affects Pakistan Nuclear Regulatory Authority (PNRA) Mail server / internal, maps to 15 MITRE ATT&CK techniques (T1005, T1036, T1078), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1ModernStealer
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1836
- Threat ID
- TL-2026-1836
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- ModernStealer
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- government administration, defense, aerospace, nuclear energy regulatory, military, police - law enforcement, intelligence
- Target regions
- South Asia, East Asia, Middle East, North America, 151 - Eastern Europe, 143 - Central Asia
- Detection rules
- 9
- Indicators of compromise
- 29
How ModernStealer works
StealthMole analysts linked a dark web/Telegram actor identity cluster operating under the names ModernStealer, Zu1f1q4r, Sassoon Don, and PriorOps via shared operational contact identifiers (Session, Tox, and Telegram IDs). The cluster has posted unverified listings claiming to sell data allegedly sourced from Pakistani, Turkish, Bangladeshi, Chinese, and US government/defense-linked organizations, including an April 2026 claim of a Pakistan Nuclear Regulatory Authority (PNRA) mail-server compromise. StealthMole and Cyber Security News explicitly caveat that the listings are unconfirmed claims, not proof of breach.
In a report titled "The Many Faces of ModernStealer: Tracing the Underground Identities," shared with Cyber Security News in July 2026 and published August 3, 2026, dark-and-deep-web intelligence firm StealthMole documented a cluster of dark web forum and Telegram personas — ModernStealer, Zu1f1q4r, Sassoon Don, and PriorOps — that it assesses to be a single operator group (or tightly coordinated group) rather than unrelated sellers. Rather than relying on usernames, which are trivially changed, StealthMole's analysts traced "durable identifiers" — a recurring Session messenger contact ID, a Tox ID, and Telegram account/channel IDs — that recur across dozens of listings on dark web forums (DarkForums, Breached.live) and in direct Telegram contact information.
The investigation's trigger was a DarkForums post advertising alleged documentation of a Türkiye-Pakistan drone partnership referencing Baykar Teknoloji and technology-transfer material. Pivoting on the Session ID attached to that post, StealthMole found the same identifier embedded in five ModernStealer listings and eight separate government-related advertisements, and the same identifier surfaced across 30 indexed forum threads posted under the Zu1f1q4r handle. Cross-referencing further tied these to Telegram accounts, with the Sassoon Don persona later appearing directly in posts advertising military documents, and a separate operator, PriorOps, was found using the same Telegram handle infrastructure.
Separately, on April 17, 2026, an actor identified as ModernStealer posted on DarkForums.su claiming to have breached the Pakistan Nuclear Regulatory Authority (PNRA) mail server and exfiltrated "over 60 databases," with 17 datasets (3.2 GB) offered for immediate sale and the remainder to follow. The claimed data included precise locations of nuclear reactors, chemical laboratory locations, employee information/email addresses, and other infrastructure-related documentation — no pricing was disclosed in that listing.
Across the broader cluster's DarkForums and Breached.live postings, claimed victims span Pakistan (PNRA, the National Aerospace Science and Technology Park, NUST, SUPARCO, the Pakistan Military procurement apparatus, the Intelligence Bureau, and the Federal Investigation Agency), Turkey (Baykar Teknoloji drone/technology-transfer material), Bangladesh (military records), China (claimed PLA personnel database), and unspecified US defense-linked bodies. StealthMole and the source article are explicit that these are unconfirmed marketplace claims: "The activity is not a confirmed malware campaign or proof that every named organization was breached," characterizing the cluster as operating "a marketplace and messaging ecosystem, not a disclosed software exploit." Sellers on these forums have a well-documented history of exaggerating scope, recycling older leaked datasets, or fabricating samples to build buyer trust (as seen in a separate, subsequently debunked 2023 claim of a Baykar Teknoloji TB2 source-code leak by an unrelated actor), so severity is held at MEDIUM pending independent verification of any specific claim.
Defensively, StealthMole and downstream analysts recommend that named/adjacent organizations independently validate any specific claim before triggering incident response, preserve relevant logs, compare any obtained samples against internal records, reset credentials only where evidence supports actual compromise, and monitor DarkForums, Breached.live, and the identified Telegram/Session/Tox channels for follow-on postings from this identifier cluster.
MITRE ATT&CK techniques used in TL-2026-1836
Collection
T1005 Data from Local System; T1114 Email Collection; T1213 Data from Information Repositories
Defense Evasion
Initial Access
Command and Control
T1102 Web Service; T1573 Encrypted Channel
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities; T1650 Acquire Access
Reconnaissance
T1589 Gather Victim Identity Information; T1593 Search Open Websites/Domains; T1594 Search Victim-Owned Websites
Affected products and versions in ModernStealer
- Pakistan Nuclear Regulatory Authority (PNRA) — Mail server / internal databases (claimed exfiltration, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Baykar Teknoloji — Drone partnership / technology-transfer documentation (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Pakistan National Aerospace Science and Technology Park (NASTP) — Internal documentation (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - NUST / SUPARCO (Pakistan) — Internal documentation (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Pakistan Military / Intelligence Bureau / Federal Investigation Agency — Procurement records and internal documents (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Unnamed Chinese defense-linked organization (People's Liberation Army) — PLA personnel database, advertised by PriorOps (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Unnamed US defense body — Unspecified defense-linked data (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Bangladesh Military — Military records (claimed, unconfirmed)
Vulnerable versions: N/A - dark web breach claim, not a software vulnerability - Unspecified Ukrainian government body — Classified documents solicited by the Sassoon Don persona (unconfirmed acquisition target, not a claimed completed breach)
Vulnerable versions: N/A - dark web solicitation, not a software vulnerability - Unspecified Central Asian government bodies — Classified documents solicited by the Sassoon Don persona (unconfirmed acquisition target, not a claimed completed breach)
Vulnerable versions: N/A - dark web solicitation, not a software vulnerability
Remediation for ModernStealer
Immediate actions
- Treat all cluster listings as unverified claims and independently validate before triggering formal incident response
- Named/adjacent organizations (PNRA, NASTP, NUST, SUPARCO, Baykar Teknoloji, Pakistan Intelligence Bureau, Pakistan FIA, Pakistan Military procurement bodies) should search internal logs for anomalous mail-server authentication or bulk mailbox export activity around and before April 17, 2026
- Preserve mail server, authentication, and data-access logs covering the claimed compromise windows before they age out of retention
- If a data sample is obtained, compare field structure and specific records against internal systems rather than accepting the listing's framing at face value
- Reset credentials and rotate mail-server service accounts only where log evidence actually supports compromise, not on the basis of the claim alone
Longer-term hardening
- Deploy dark web / Telegram / Session / Tox monitoring for organization name, domain, and employee-email matches to catch follow-on postings from this identifier cluster early
- Implement mailbox and mail-server anomaly detection (bulk export, unusual IMAP/EWS access patterns, off-hours administrative logins)
- Adopt phishing-resistant MFA and conditional access on mail infrastructure for government/defense/nuclear-regulatory bodies named in the cluster's claims
- Establish a standing process with national CERTs for triage of dark-web breach-claim listings referencing government or defense entities
Timeline of ModernStealer
- Following BreachForums' seizure in April 2025, DarkForums (launched 2022 as "DARK4RMY Forums", under admin "Knox" since August 2024) absorbs a large share of displaced users, seeing a 600% surge in forum activity between April and June 2025 and adopting BreachForums-style leaked-database, stealer-log, and combo-list listings — the ecosystem in which the ModernStealer cluster's DarkForums.su postings later appear (month-level date per source).
- An actor identified as ModernStealer posts a listing on DarkForums.su claiming to have breached the Pakistan Nuclear Regulatory Authority (PNRA) mail server and exfiltrated 60+ internal databases, offering 17 datasets (3.2 GB) covering nuclear reactor locations, chemical laboratory locations, and employee/email data; no price is disclosed in the listing.
- A separate operator, PriorOps, is identified advertising a claimed People's Liberation Army (PLA) personnel database while reusing the same Telegram handle infrastructure as the Sassoon Don persona (month-level date per source: July 2026).
- The Sassoon Don Telegram persona is observed appearing directly in posts advertising military documents; ModernStealer subsequently lists the Sassoon Don account as a contact option in its own military-document posts, converging the two identities (month-level date per source: July 2026).
- The Sassoon Don Telegram persona, using the same Session contact identifier as the wider cluster, is observed seeking (soliciting/attempting to acquire) classified documents about Ukraine and Central Asian countries (month-level date per source: July 2026).
- Threads attributed to the Zu1f1q4r handle on Breached.live/DarkForums advertise Pakistan Military procurement records, Pakistan Intelligence Bureau material, and Pakistan Federal Investigation Agency documents (month-level date per source: July 2026).
- StealthMole traces a recurring Session messenger contact ID across five ModernStealer listings, eight government-related advertisements, and 30 indexed Zu1f1q4r forum threads, establishing the cross-alias identity cluster; StealthMole notes the shared identifier proves operational overlap but not that ModernStealer and Zu1f1q4r are the same individual, allowing for a group sharing infrastructure (month-level date per source: July 2026).
- A DarkForums post advertising alleged documentation of a Türkiye-Pakistan drone partnership (referencing Baykar Teknoloji and technology-transfer material) surfaces and becomes StealthMole's investigative trigger for the broader identity-cluster analysis (month-level date per source: July 2026).
- StealthMole shares its report "The Many Faces of ModernStealer: Tracing the Underground Identities" with Cyber Security News (month-level date per source: July 2026).
- Cyber Security News publishes the StealthMole findings publicly, disclosing the ModernStealer/Zu1f1q4r/Sassoon Don/PriorOps identity cluster and its claimed government/defense-linked targets across Pakistan, Turkey, Bangladesh, China, and the US, and reiterating that the cluster is a marketplace/messaging ecosystem, not a disclosed software exploit or confirmed malware campaign.
Sources cited for ModernStealer
- ModernStealer Threat Actor: StealthMole Links Dark Web/Telegram Identity Cluster to Government and Defense Data Claims
- April 17, 2026 Daily Cybersecurity Threat Report (ModernStealer claims PNRA mail-server breach)
- StealthMole - Dark Web Threat Intelligence Platform
- Inside DarkForums: BreachForums' successor
- BreachForums Hack: Hackers Expose All User Records from Popular Dark Web Forum
- Top 10 Dark Web And Deep Web Forums In 2026
Detection coverage for TL-2026-1836
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1836 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.