This report presents an in-depth profile of an underground cyber actor operating under the alias 1ucif3r, also known as Lucifer. Leveraging the investigative capabilities of the StealthMole platform, this profile consolidates information derived from historical breach datasets, forum activity, dark web infrastructure, and open-source intelligence (OSINT). 1ucif3r has maintained an active digital footprint since at least 2021 and is believed to be based in ******, based on recurring indicators such as domain registration, language use, school-linked credentials, and Telegram group memberships.
1ucif3r is not only known for operating in breach and exploit communities but also attempts to cultivate an identity through branded assets such as "DARKARMY", GitHub repositories, and personalized onion sites. While there is speculation around his ties to the ransomware group "D4RK 4RMY," this report maintains separation between the two identities due to the lack of direct technical links. The analysis focuses solely on 1ucif3r’s independent operational identity.
1ucif3r’s emergence can be traced back to high-profile breach incidents that surfaced throughout 2023 and 2024, which were detected and catalogued via StealthMole’s ransomware and leak monitoring tools. These events illustrate a pattern of attacking state-linked or military-grade targets, likely to maximize geopolitical impact and underground recognition.
2. South Korea Military Database Breach (2023)
3. Vietnam Government Webmail Leak (2024)
4. Iraq National Security Database (2023)
uberhub.uberinternal.com.