# ModernStealer: Cross-Platform Dark Web/Telegram Broker Network Claims Sale of Government and Defense Data

> StealthMole analysts linked a dark web/Telegram actor identity cluster operating under the names ModernStealer, Zu1f1q4r, Sassoon Don, and PriorOps via shared operational contact identifiers (Session, Tox, and Telegram IDs). The cluster has posted unverified listings claiming to sell data allegedly sourced from Pakistani, Turkish, Bangladeshi, Chinese, and US government/defense-linked organizations, including an April 2026 claim of a Pakistan Nuclear Regulatory Authority (PNRA) mail-server compromise. StealthMole and Cyber Security News explicitly caveat that the listings are unconfirmed claims, not proof of breach.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1836
- **ID:** TL-2026-1836
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** ModernStealer
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a report titled "The Many Faces of ModernStealer: Tracing the Underground Identities," shared with Cyber Security News in July 2026 and published August 3, 2026, dark-and-deep-web intelligence firm StealthMole documented a cluster of dark web forum and Telegram personas — ModernStealer, Zu1f1q4r, Sassoon Don, and PriorOps — that it assesses to be a single operator group (or tightly coordinated group) rather than unrelated sellers. Rather than relying on usernames, which are trivially changed, StealthMole's analysts traced "durable identifiers" — a recurring Session messenger contact ID, a Tox ID, and Telegram account/channel IDs — that recur across dozens of listings on dark web forums (DarkForums, Breached.live) and in direct Telegram contact information.

The investigation's trigger was a DarkForums post advertising alleged documentation of a Türkiye-Pakistan drone partnership referencing Baykar Teknoloji and technology-transfer material. Pivoting on the Session ID attached to that post, StealthMole found the same identifier embedded in five ModernStealer listings and eight separate government-related advertisements, and the same identifier surfaced across 30 indexed forum threads posted under the Zu1f1q4r handle. Cross-referencing further tied these to Telegram accounts, with the Sassoon Don persona later appearing directly in posts advertising military documents, and a separate operator, PriorOps, was found using the same Telegram handle infrastructure.

Separately, on April 17, 2026, an actor identified as ModernStealer posted on DarkForums.su claiming to have breached the Pakistan Nuclear Regulatory Authority (PNRA) mail server and exfiltrated "over 60 databases," with 17 datasets (3.2 GB) offered for immediate sale and the remainder to follow. The claimed data included precise locations of nuclear reactors, chemical laboratory locations, employee information/email addresses, and other infrastructure-related documentation — no pricing was disclosed in that listing.

Across the broader cluster's DarkForums and Breached.live postings, claimed victims span Pakistan (PNRA, the National Aerospace Science and Technology Park, NUST, SUPARCO, the Pakistan Military procurement apparatus, the Intelligence Bureau, and the Federal Investigation Agency), Turkey (Baykar Teknoloji drone/technology-transfer material), Bangladesh (military records), China (claimed PLA personnel database), and unspecified US defense-linked bodies. StealthMole and the source article are explicit that these are unconfirmed marketplace claims: "The activity is not a confirmed malware campaign or proof that every named organization was breached," characterizing the cluster as operating "a marketplace and messaging ecosystem, not a disclosed software exploit." Sellers on these forums have a well-documented history of exaggerating scope, recycling older leaked datasets, or fabricating samples to build buyer trust (as seen in a separate, subsequently debunked 2023 claim of a Baykar Teknoloji TB2 source-code leak by an unrelated actor), so severity is held at MEDIUM pending independent verification of any specific claim.

Defensively, StealthMole and downstream analysts recommend that named/adjacent organizations independently validate any specific claim before triggering incident response, preserve relevant logs, compare any obtained samples against internal records, reset credentials only where evidence supports actual compromise, and monitor DarkForums, Breached.live, and the identified Telegram/Session/Tox channels for follow-on postings from this identifier cluster.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1594 Search Victim-Owned Websites
- T1589 Gather Victim Identity Information
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1650 Acquire Access
- T1078 Valid Accounts
- T1036 Masquerading
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1102 Web Service
- T1573 Encrypted Channel

## Sources

- [ModernStealer Threat Actor: StealthMole Links Dark Web/Telegram Identity Cluster to Government and Defense Data Claims](https://cybersecuritynews.com/modernstealer-threat-actor/)
- [April 17, 2026 Daily Cybersecurity Threat Report (ModernStealer claims PNRA mail-server breach)](https://thedailytechfeed.com/april-17-2026-daily-cybersecurity-threat-report/)
- [StealthMole - Dark Web Threat Intelligence Platform](https://www.stealthmole.com/)
- [Inside DarkForums: BreachForums' successor](https://www.aazani.nl/articles/inside-darkforums-breachforums-successor)
- [BreachForums Hack: Hackers Expose All User Records from Popular Dark Web Forum](https://cybersecuritynews.com/breachforums-hack/)
- [Top 10 Dark Web And Deep Web Forums In 2026](https://cyble.com/knowledge-hub/top-10-dark-web-forums/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1836