@grey@infosec.exchange

grey

@grey@infosec.exchange · Jul 04, 2026

Replying to @alice@lgbtqia.space

@alice@lgbtqia.space @cR0w@infosec.exchange

2

0

grey

@grey@infosec.exchange · Jul 04, 2026

Happy 4th of Shit. Don't forget that today is about watering the tree of liberty.

0

grey

@grey@infosec.exchange · May 10, 2026

Replying to @darfplatypus@infosec.exchange

@darfplatypus@infosec.exchange Close enough

3

0

grey

@grey@infosec.exchange · May 10, 2026

Anyone got a paper on the intricacies of training a submissive with NIST800 guidelines? Asking for a friend...

6

7

2

0

grey

@grey@infosec.exchange · May 09, 2026

Replying to @zackwhittaker@mastodon.social

@zackwhittaker@mastodon.social They were hacked 3 times. Once in Sept 2025, Once around April 30th, and again May 7th.

6

0

1

0

grey

@grey@infosec.exchange · May 08, 2026

Replying to @darfplatypus@infosec.exchange

@darfplatypus@infosec.exchange I should get a fake license plate for my bike :asuna_but:

3

2

0

grey

@grey@infosec.exchange · May 05, 2026

Replying to @cR0w@infosec.exchange

@cR0w Pretty sure that's just a textbook extortion racket

4

1

0

grey

@grey@infosec.exchange · May 03, 2026

Replying to @cR0w@infosec.exchange

@cR0w@infosec.exchange I feel like that's too kind to them. They're far from beautiful

3

0

grey

@grey@infosec.exchange · Apr 18, 2026

Happy record store day to those who celebrate! Support your local small business record stores ❤️ https://recordstoreday.com/
#recordstoreday

12

0

10

0

grey

@grey@infosec.exchange · Apr 18, 2026

Replying to @catsalad@infosec.exchange

@catsalad @gayint @chillybot criminals

4

1

0

grey

@grey@infosec.exchange · Apr 06, 2026

The cybersecurity industry is in it's nuclear scare era. Everyone is hypecycle focused on the newest biggest bomb while losing to poor rice farmers with wooden guns.

#threatintel #threatintelligence #cybersecurity

25

1

8

0

grey

@grey@infosec.exchange · Sep 21, 2025

I'm so proud of my friends @TindrasGrove@infosec.exchange and @Dio9sys@haunted.computer who presented at @pancakescon@infosec.exchange today. They both absolutely killed it

infosec.exchange

Tindra (@TindrasGrove@infosec.exchange) - Infosec Exchange

0

1

0

grey

@grey@infosec.exchange · Sep 21, 2025

I'm so proud of my friends @TindrasGrove@infosec.exchange and @Dio9sys@haunted.computer who presented at @pancakescon@infosec.exchange today. They both absolutely killed it

infosec.exchange

Tindra (@TindrasGrove@infosec.exchange) - Infosec Exchange

9

2

1

0

grey

@grey@infosec.exchange · Jun 18, 2025

Replying to @grey@infosec.exchange

Finally had some more free time. Ran the data we have so far through leaked databases and the results confirm our previous OSINT. -GameSprite Email: shadowgamer5628@gmail.com Password: 14389e232e2da8a35e45a34dae245407 Registration: 2017-05-29 19:09:11 Salt: 78d2c0 IP: 191.102.75.226 Nick: ShadowGRT -SoarGames Email: shadowgamer5628@gmail.com Password: a00080f376b0e18de43185e4a66259d2 Registration: 2018-05-19 19:49:16 Salt: c97dcf IP: 152.231.29.35 Nick: Shadowgrt -Canva Email: shadowgamer5628@gmail.com Registration: 2017-11-27 20:13:29 Language: es-CO Nick: shadowgamer5628 -Wattpad Email: shadowgamer5628@gmail.com Registration: 2017-10-23 02:52:20 Full name: Shadow GRT Nick: ShadowGRT Country: CO (8/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

2

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

Using Sherlock (https://github.com/sherlock-project/sherlock) we can find a few other accounts to widen the amount of datapoints we have: DuoLingo: https://www.duolingo.com/profile/SHADOWGRT (https://archive.ph/I2bNH) Wattpad: https://www.wattpad.com/user/ShadowGRT (https://archive.is/LRrLq) Steam: https://steamcommunity.com/id/ShadowGRT/ (https://archive.is/VzTo7) - This shows the name "Germán Trejos" - We'll come back to this. Roblox: https://www.roblox.com/users/643063460/profile (https://archive.is/jFOZB) RuneScape: https://apps.runescape.com/runemetrics/app/overview/player/ShadowGRT (https://archive.is/DuocM) (7/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

5

1

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

Looking back at the Youtube account (archived here: https://archive.is/n9xEA#selection-3587.416-3611.0) we see additional social account details in the description of a recent video: Mis redes: Twitter: https://twitter.com/GermanRaul10 Instagram: https://www.instagram.com/german_t01/ Correo: shadowgamer5628@gmail.com Skype: ShaDow Grt Discord: ShaDowGRT #4582 This also confirms the gmail account originally seen in the git commit is indeed related to this person. (6/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

1

2

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

Pivoting to the Twitter account (Archived here: https://archive.is/50Q3U#selection-735.0-735.13) we see more location details of Putumayo, Colombia. This is within a short distance of the Google Maps reviews in Meta, Columbia . Helping us correlate the geolocation of this person. We also get a hint to what be their real name of pseudonym "German Raul" (5/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

1

3

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

Pivoting to YouTube first we find https://www.youtube.com/c/ShadowGRT This fits Censys reporting of Minecraft videos. Immediately I always check the other profile links to find other accounts: https://twitter.com/GermanRaul10 https://plus.google.com/112604768676644210605?hl=es https://instagram.com/german_t01 https://twitch.tv/shadowgrt (4/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

2

4

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

Taking a look at their Maps data: https://www.google.com/maps/contrib/112604768676644210605/reviews we can confirm they spent time in Columbia within the past 3-6 years. We also see the username mentioned in the Censys report "Shadow GRT" Let's pivot off of ShadowGRT and find those other accounts mentioned by Censys. (3/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

3

5

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

The Ghunt output provides us with a few good leads. First it confirms that it's a valid gmail account. Second it provides links to the TA's Google Maps reviews.

grey@thruntmachine:~$ ghunt email shadowgamer5628@gmail.com

         By: mxrch (🐦 @mxrchreborn)
   Support my work on GitHub Sponsors ! 💖


     > GHunt 2.3.3 (🕷  Spider Edition) <

🎉 You are up to date !

[+] Stored session loaded ! [+] Authenticated !

🙋 Google Account data

[+] Custom profile picture ! => https://lh3.googleusercontent.com/a-/ALV-UjVyN5P4R9BhUF4W6b8P-zSsuy32A0AsMRd2P9G3VeMGM3JE4HAj

[-] Default cover picture

Last profile edit : 2025/05/05 09:34:18 (UTC)

Email : shadowgamer5628@gmail.com Gaia ID : 112604768676644210605

User types :

GOOGLE_USER (The user is a Google user.)

📞 Google Chat Extended Data

Entity Type : PERSON Customer ID : Not found.

🌐 Google Plus Extended Data

Entreprise User : False

🎮 Play Games data

[+] New token for playgames has been generated

[-] No player profile found.

🗺 Maps data

Profile page : https://www.google.com/maps/contrib/112604768676644210605/reviews

[Statistics] Ratings : 6

[-] Reviews are private.

🗓 Calendar data

[-] No public Google Calendar.

(2/???)

#OSINT #OPSECFAIL #CTI #ThreatIntel

3

6

0

grey

@grey@infosec.exchange · Jun 13, 2025

Replying to @grey@infosec.exchange

One of the best indicators Censys found for attribution is the email address accidentally left in a git commit: % git log commit fa480e80bc5b9e154fad138ef47191032e7ba4dd (HEAD -> main, origin/main, origin/HEAD) Author: Shadow GRT Date: Wed May 7 15:51:15 2025 +0000 Given this is a gmail the first tool we should immediately use is GHunt (https://github.com/mxrch/GHunt) (1/???) #OSINT #OPSECFAIL #CTI #ThreatIntel

2

7

1

0

grey

@grey@infosec.exchange · Jun 13, 2025

Saw @censys@infosec.exchange awesome blog about Columbian C2 servers (https://censys.com/blog/unmasking-the-infrastructure-of-a-spearphishing-campaign) and thought I'd do a quick OSINT walkthrough.

Thread below !

(0/???)

#OSINT #OPSECFAIL #CTI #ThreatIntel

infosec.exchange

Censys (@censys@infosec.exchange) - Infosec Exchange

11

8

5

0

grey

@grey@infosec.exchange · Jun 06, 2025

Replying to @alice@lgbtqia.space

@alice @darfplatypus

1

0

grey

Posts

Tindra (@TindrasGrove@infosec.exchange) - Infosec Exchange

Tindra (@TindrasGrove@infosec.exchange) - Infosec Exchange

Censys (@censys@infosec.exchange) - Infosec Exchange

Remote instance

Media