Loading threat actor…
GordonFreeman is an underground forum persona associated with advertising government-related datasets for sale. Activity under this handle includes offering purported data from Spain’s Ministry of Science, Innovation and Universities to the highest bidder and advertising a dataset represented as Chile’s complete electoral roll, attributed to the national electoral service, SERVEL. The Chilean listing claimed approximately 13.7 million citizen records containing national identity numbers, names, addresses, and electoral assignments. The authenticity and provenance of these datasets have not been independently established; legally published electoral records could account for the Chilean data without a compromise of SERVEL. No intrusion techniques or data-exfiltration capabilities have been independently verified for this persona. The observed sales activity indicates a financial motivation.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.