✅ Report Title: Threat Group Profiling: 888

✅ Executive Summary

- 888 is a threat group that began its activities in August 2023 after registering on the dark web hacking forum Breachforums under the username “888,” gaining attention by claiming intrusions and posting sales advertisements for Oracle employee information, IBM employee information, and Shopify databases.

📌 Who Is the 888 Group?

- In August 2023, the group registered on the dark web hacking forum Breachforums using the username 888 and began forum activities.

- After initiating forum activities, the group leaked and sold Database, Access, and Document data belonging to companies across various countries and industries.

- The number “8” has a pronunciation similar to 发 (fa) from 发财, meaning “to make money,” and is commonly used by Chinese users; however, no direct association between the 888 user and China has been confirmed.

📌 Major Activity History

- The group has a history of serving as a Moderator on Breachforums starting January 24, 2025.

- On Breachforums, the group operated as part of the Cyberniggers group alongside the user Intelbroker. Despite Breachforums being shut down and forum activities being disrupted following the arrest of Intelbroker and other key members, the 888 user continues to operate as Cyberniggers on Darkforums.

- The primary target country of the 888 user has been identified as the United States.

- The group has conducted data theft and sales activities targeting a wide range of industries worldwide, including software, IT, and automotive sectors.

📌 Attack Patterns

- The group primarily posts data obtained through third-party attacks and leaks some databases with relatively limited impact; however, detailed attack techniques have not been confirmed.

📌 OSINT Analysis Results of the 888 Group

- An investigation covering major DDW forums and approximately 700 surface web sites found no additional activities related to the 888 user.

- The group does not appear to engage in Telegram-based activities or operate Telegram channels.

🧑‍💻 Author: S2W TALON

👉 Contact us: https://s2w.inc/en/contact

*The full report is available upon request or with a subscription to the S2W platform.