The Hackers Crew That Took a National Police Force With a Stolen Password

Bottom line: A cluster of four handles has spent seven weeks taking administrator accounts on public-facing government and corporate portals, almost entirely through credential reuse and broken authorisation rather than malware. On 6 October they stopped attacking institutions directly and compromised a Nepalese IT supplier instead, claiming admin access across more than 170 downstream clients. Ten Nepali government bodies are named in that single post.

The 6 October post, signed by all four handles, listing downstream government clients of a single compromised Nepali IT provider

ZentinelTeam Posts alone and jointly. Also appears once as Zentinel Team

Keishellnever appears without noname8173

noname8173never appears without Keishell

We assess with moderate confidence that these handles operate as one unit. The basis is co-signing on shared posts with identical victim sets, and the absolute pairing of Keishell and noname8173 across all ten of their posts. We found no shared infrastructure or reused sample hosts, and a single operator could plausibly run all four handles. Treat the cluster as a tracking label, not a headcount.

The pairing matters operationally: Keishell and noname8173 were active on 16 August, before their first joint post with ZentinelTeam on 19 August. From 9 September onward, every post is joint.

The escalation

August was single-target work. Peru's Pronabec scholarship intranet (3,000+ accounts). Brazil's Ministry of Culture. hacienda.gob.mx, a Mexican finance ministry account taken with leaked credentials and weak authentication. A Spanish union site hit three separate times across eight days — a sign they re-enter and re-harvest rather than dump once and move on.

Early September broadened the target set without changing the method: one administrator account spanning five Kenyan betting operators (betika.com, portpesa.com, betking.com, Betsawa, Spotek-Pro), SAGE Publishing's editorial platform (120,000 user records), ryxcars.com in Dubai, rincao.sp.gov.br, and vnsw.gov.vn, Vietnam's customs portal.

One administrator account, five gambling operators — the cluster's preferred economics before the supplier pivot.

From 9 September the targeting turns to infrastructure. opticnetworks.com.co, a Colombian ISP, where the post states intent to disrupt service, not merely exfiltrate. Two days later, Alfatihnet, an Indonesian ISP: FTTH/GPON admin with control of network devices and user management. On 12 September they defaced ucv.edu.pe alongside a second Peruvian site. On 2 October, a permissions flaw on edojudiciary.gov.ng gave administrative reach over a claimed 52 million court records.

The first post where the cluster signals service disruption rather than data theft.

Why the Nepal post is different

Every prior operation scaled by target count. This one scaled by position. Compromising the provider inherited every client relationship at once: Nepal Police Headquarters, the Department of National Personnel Records, the Ministry of Home Affairs and Communication, the Office of the Chief Minister and Council of Ministers, the Secretariat of the Provincial Assembly, the Provincial Infrastructure Development Authority, Lumbini Technological University, and the municipalities of Bhaktapur, Tokha and Ratnanagar.

The cluster did not develop a new capability to achieve this. The same credential-and-authorisation tradecraft that took a union website in August took a national police force's supplier in October. The variable was target selection.

Privilege escalation via a permissions flaw — no exploit chain, no malware.

Observed TTPs

• T1078 Valid Accounts — the primary vector. Leaked or weak credentials against administrator logins on public portals. Named explicitly on the hacienda.gob.mx and Kenyan operator posts.

• T1068 / authorisation bypass — privilege escalation through broken permission checks, as described on edojudiciary.gov.ng.

• T1199 Trusted Relationship — the Nepal supplier compromise, used to reach government clients.

• T1213 Data from Information Repositories — CRM and admin-panel harvesting, repeated across Rincão, UCV and GB Motor.

• T1491.002 External Defacement — used selectively, after exfiltration.

No malware, no phishing infrastructure, no zero-days in any of the 21 posts.

Actions

If you are a government body in Latin America, South Asia, South East Asia or West Africa: inventory which IT suppliers hold administrative credentials into your portals, and require each to confirm MFA on those accounts in writing. Supplier admin access is this cluster's current route in.

Check the named domains. If your organisation appears above, assume administrator credentials are compromised: force rotation, invalidate sessions, and review admin audit logs from the post date backwards, not forwards.

Hunt specifically: administrator logins from unexpected ASNs; successful authentication to an admin path with no preceding failures; and horizontal access to records outside a role's normal scope, which is how the authorisation flaws were found.

Prioritise re-entry over first entry. The three separate posts against one Spanish domain show this cluster returns. A single rotation after a public post is not remediation.

Outlook

The supplier pivot worked and was publicised. We expect this cluster to continue targeting regional IT and managed service providers in the same geographies, because the return per compromise is now an order of magnitude higher at no additional technical cost. Organisations with low direct exposure may hold high inherited exposure through a provider.

ZentinelTeam, Keishell and noname8173 co-signing — the pattern underpinning the cluster assessment.