ZeroFox Intelligence Flash Report: Actor Seemingly Claims Responsibility for Recent Breaches

ZeroFox Intelligence Flash Report - Actor Seemingly Claims Responsibility for Recent Breaches

Product Serial: F-2025-05-16b

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on recent statements by "Machine1337" posted in a dark web forum and an instant messaging platform, which seemingly claim responsibility for a series of recent prominent breaches.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• A prominent and well-regarded threat actor known as “Machine1337” (who is also known as “EnergyWeaponUser”) has claimed responsibility for at least seven recent cyberattacks within both the primarily Russian-speaking dark web forum xss and the actor’s Telegram channel.
• Posts by the actor alluded to unspecified data allegedly stolen from Apple Inc., Steam, Huawei, Temu, and Snapchat. While data samples were seemingly made available, forum users claim that they are not accessible.
• Separately, on May 15, 2025, the U.S.-based cryptocurrency exchange platform Coinbase released a statement acknowledging a recent breach that resulted in stolen customer data.
• On May 15, 2025, ZeroFox observed that Machine1337 posted a message on their Telegram channel that stated “CoinBase: Coming soon”. While this does not indicate Machine1337 is directly involved in the Coinbase compromise, it does suggest a possible connection between the actor and this recent breach incident, which has yet to be officially claimed by any threat actor or group.