The Mosad Playbook: How One Alias Built a Cross-Platform Leak Network

Underground data leak operators rarely rely on a single platform. To reach buyers, build credibility, and keep their content available despite takedowns or forum closures, they often maintain a presence across multiple forums, encrypted messaging platforms, and mirrored communities. What begins as a single leak advertisement can quickly branch into a much larger network of accounts, channels, and communication points that are designed to reinforce one another.

This investigation began with the alias Mosad, an active seller advertising alleged government, military, and law enforcement datasets across several underground forums. Rather than examining the advertised leaks in isolation, the investigation followed the digital trail left behind by the alias itself. By pivoting across forum profiles, Telegram channels, and shared identifiers, it became possible to map a broader ecosystem that extended well beyond individual posts.

The findings show how a single underground identity can establish a coordinated presence across multiple platforms, using interconnected infrastructure to distribute content, promote new leak announcements, and direct users toward associated communities. This report documents that network and demonstrates how following one alias can uncover a much wider operational footprint than initially appears.

Following the First Lead

The investigation began after Mosad was flagged in StealthMole's Suspect Tracker as a database seller. To understand whether the alias was associated with a broader operation, the first step was to search the username across StealthMole's datasets rather than focusing on a single forum post.

An initial search in Leaked Monitoring returned 36 listings published between April and June 2026, many of which advertised alleged government, military, and law enforcement data. Instead of targeting a single country or organization, the listings referenced a wide range of sensitive material, including documents allegedly linked to intelligence agencies, diplomatic communications, defense organizations, and police departments. The volume and consistency of these advertisements suggested that Mosad was maintaining an active presence rather than promoting a one-off leak.

To better understand how these listings were being distributed, one of the advertisements was selected for closer examination. Beyond the advertised dataset itself, the thread contained several communication points, including a Telegram account, along with additional identifiers that could be used to trace the actor across other platforms. Rather than marking the end of the investigation, the forum post became the first pivot into a much larger network.

• https://darkforums.**/Thread-Selling**********1B-Revenue-FOR-SALE

The First Pivot

The DarkForums thread titled "Selling 80k+ Working Access to Fortune Companies ($1B+ Revenue) FOR SALE" was selected for closer examination as it offered more than a typical marketplace advertisement. While the post promoted access to compromised corporate environments, it also served as a central point for directing prospective buyers toward the actor's preferred communication channels. Unlike many underground listings that simply advertise a product, this thread exposed several operational identifiers that could be used to continue the investigation beyond the forum itself.

The thread was further analyzed using StealthMole's Dark Web Tracker, which extracted the communication points embedded within the page. The following identifiers were recovered:

• Telegram: https://t.me/m*********d
• Jabber: c******@jabber.fr
• Session ID: 0520*************************************15c696b
• TOX ID: AA39*******************************************5007

The thread also reflected a posting style that appeared repeatedly throughout the investigation. In addition to the sale advertisement, it included preview material intended to demonstrate the value of the offering, a consistent profile image associated with the alias, and clearly defined communication channels for buyer engagement. These recurring elements suggested that the advertisement was part of a structured operational approach rather than an isolated forum post.

At this stage, the communication identifiers themselves were more valuable than the advertised dataset. Each represented a potential pivot into another platform or service, allowing the investigation to move beyond individual forum advertisements and begin reconstructing the broader infrastructure supporting the Mosad alias.

One Alias, Many Forums

The communication identifiers recovered from the initial DarkForums advertisement became the next investigative pivot. Using StealthMole's Dark Web Tracker, the username mosad was searched across indexed underground forums to determine whether the actor maintained additional identities or advertisements elsewhere.

The search revealed that the same alias maintained a widespread presence across multiple underground communities. Rather than operating from a single marketplace, Mosad was found advertising alleged government, military, intelligence, and law enforcement datasets while maintaining profile pages across numerous forums.

• https://shieldforum.***/members/mosad****/
• https://demonforums.****/mosad
• https://spear.**/***mosad
• https://pwnforums.**/****mosad
• https://breachforum.**/***mosad
• https://breached.**/***mosad
• https://breached.**/members/mosad***/
• https://darkforums.**/**mosad
• https://raidforums.***/****mosad

The same search also uncovered advertisements distributed across multiple underground forums, including:

• https://shieldforum.***/threads/rus-secret-fsb-ukraine*******25/
• https://breached.**/threads/rus-secret-fsb-ukraine***********35/
• https://darkforums.**/Thread-DATABASE-USA-New-York**********LEAK
• https://spear.**/Thread-Free-NATO**********************GREENLAND
• https://pwnforums.**/Thread-DOCUMENTS************************LEAK
• https://xforums.**/threads/usa-virginia***********************25/

Across these posts, several recurring characteristics emerged. The advertisements consistently focused on alleged government, military, intelligence, and law enforcement material, while the same profile image and @mosad branding appeared repeatedly. Sample images of the purported datasets were also embedded within several listings, including documents presented as classified South Korean defense material bearing repeated @mosad watermarks. Together, these recurring artifacts reinforced the consistency of the alias across otherwise independent underground communities.

Following the Breadcrumbs

The investigation did not end with the forum advertisements. Several of the recovered artifacts pointed directly to Telegram, suggesting that the forums were primarily being used to attract attention, while communication and content distribution continued elsewhere. Each Telegram identifier recovered during the previous stage was used as a new investigative pivot within StealthMole's Telegram Tracker.

The first pivot began with the Telegram account advertised in the DarkForums thread:

• Telegram: https://t.me/m*********d

From there, the investigation identified an interconnected network of Telegram channels and communities associated with the alias.

Telegram infrastructure identified during the investigation:

• Mosad Leaks
  • https://t.me/B*********h

• Mosad Intelligence Agency
  • https://t.me/be************e
  • Also advertised as: https://t.me/d*****r

• InsideMossad
  • https://t.me/*********d

• Telegram Chat Folder
  • https://t.me/addlist/**************k
  • Folder title: Mosad Groups

Rather than operating independently, these Telegram assets consistently referenced one another. The Mosad Groups chat folder bundled the three primary Telegram assets into a single subscription folder, allowing users to join the actor's entire communication ecosystem in one step.

This same chat folder was repeatedly embedded within multiple underground forum advertisements, alongside download links and community invitations, indicating that it formed a deliberate part of the actor's distribution strategy rather than serving as an isolated Telegram feature.

Further examination of the Telegram channels revealed additional communication artifacts that had not appeared during the initial forum analysis.

Additional identifiers recovered from Telegram included:

• Matrix: @m*******g:matrix.org

The investigation also confirmed the continued use of previously identified communication points across the Telegram ecosystem:

• Telegram: @mosad
• Jabber: calimao@jabber.fr
• Session ID: 052009b60169e247022a0f929a8a698d8551655e936cbc0103fd59d9e8315c696b
• TOX ID: AA397F6879FEC8A52CCDFEC3F4B816E61F0104E6D0FEB3AFD5D29B918A2A0232A5011FB15007

Rather than introducing new identifiers for each platform, the repeated use of the same communication artifacts across forum advertisements and Telegram channels strengthened the attribution of these assets to the same operational identity. Instead of functioning as separate communication channels, the forums and Telegram infrastructure appeared to reinforce one another, creating a consistent pathway for buyers to move from public advertisements into the actor's broader ecosystem.

A Network That Reinforces Itself

By this stage of the investigation, it had become clear that Mosad's infrastructure extended beyond maintaining accounts on multiple forums or operating several Telegram channels. Instead, the various platforms functioned as a coordinated ecosystem, with each reinforcing the others and directing users toward additional communication channels.

One of the strongest indicators of this coordination was the user Telegram account, which appeared consistently throughout the investigation. The same account was advertised within forum posts, referenced across multiple Telegram channels, and identified within the InsideMossad community. The account also reused the same profile image that appeared across the actor's underground forum profiles, providing a consistent visual identity regardless of platform.

Within the InsideMossad community, the actor also promoted additional underground profiles, further expanding the identified infrastructure.

Forum profiles shared directly by the actor included:

• https://darkforums.***/*****mosad
• https://spear.***/******mosad
• https://leakforum****/mosad
• https://patched**/User/mosad****y
• https://voided.***/mosad

Unlike profiles discovered through independent searching, these accounts were promoted directly from the actor's own Telegram community, strengthening the association between the various identities.

The investigation also identified a PGP-signed announcement published within the Mosad Intelligence Agency channel stating that m*****d was the only Telegram account the actor intended to use. While the signature itself was not independently verified during this investigation, the statement demonstrated an effort to establish a single trusted communication channel and reduce the risk of impersonation.

The investigation revealed a deliberate operational model. Underground forums were used to publish advertisements and attract potential buyers, while Telegram served as the primary communication hub through dedicated channels, community discussions, and centralized contact points. Rather than existing as isolated assets, the forums, Telegram channels, chat folder, and recurring communication identifiers formed a self-reinforcing network that allowed the Mosad alias to maintain a consistent presence across multiple underground platforms.

Conclusion

What began as the investigation of a single database seller evolved into the mapping of a coordinated cross-platform infrastructure. Starting with an alias identified in StealthMole's Suspect Tracker, each successive pivot revealed another layer of the actor's operational footprint, extending from underground forum advertisements to interconnected Telegram channels, community groups, and recurring communication identifiers.

Rather than relying on a single marketplace or communication platform, Mosad maintained a distributed presence that allowed advertisements, user profiles, and messaging channels to reinforce one another. Consistent branding, repeated contact identifiers, and self-promoted profiles created a recognizable digital identity that persisted across multiple underground communities. While the authenticity of the advertised datasets was outside the scope of this investigation, the infrastructure supporting the alias was both extensive and consistently maintained.

This investigation demonstrates how seemingly routine marketplace advertisements can provide the starting point for uncovering a much broader operational ecosystem. By correlating forum activity, messaging platforms, and shared identifiers, StealthMole transformed a single alias into a detailed map of the actor's cross-platform presence, providing analysts with a clearer understanding of how underground operators build visibility, maintain communication, and extend their reach beyond any single platform.

Editorial Note

Attribution within underground communities is rarely straightforward. Threat actors frequently reuse aliases, migrate between platforms, and adopt new communication channels to maintain their presence or avoid disruption. While no single artifact is sufficient to establish attribution on its own, correlating multiple independent indicators can reveal meaningful relationships that would otherwise remain hidden.

This investigation highlights how StealthMole's ability to connect data across forums, Telegram, and other underground sources helps analysts move beyond isolated observations and develop a more complete understanding of an actor's operational footprint.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com