Connect with us

E-Business

Check Point Exposes Notorious Hacktivist ‘VandaTheGod’

Published

on

Kindly share this post

Check Point has shared research detailing its investigation to expose the real identity of a notorious super-hacker who has been responsible for attacks on 4 820 Web sites, the theft of the private data of around one million people, and the sale of stolen credit cards.

In addition, for the last seven years, official Web sites belonging to governments worldwide were hacked and defaced by this hacker, who identified himself as ’VandaTheGod’. The hacks push an anti-establishment message and were carried out, he claimed, to combat social injustices that the hacker believed were a direct result of government corruption.

He targeted governments in numerous countries, including South Africa, Brazil, the Dominican Republic, Trinidad and Tobago, Argentina, Thailand, Vietnam, and New Zealand.

He was certainly cunning, but not too clever, as a silly mistake on Facebook exposed him, and will likely seal his fate.

“The person behind the ‘VandaTheGod’ persona has used multiple aliases over the years, including ‘Vanda de Assis’ or ’SH1N1NG4M3’, and was highly active on social media, primarily Twitter,” says Check Point. “They would often share the results of those hacking endeavours with the public. A link to this Twitter account would sometimes even be added to the message VandaTheGod left on compromised Web sites, confirming that this profile was in fact managed by the attacker.”

Many of the tweets in this account were written in Portuguese, and the hacker claimed to be a part of the “Brazilian Cyber Army” or “BCA”, often displaying BCA’s logo in screenshots of compromised accounts and Web sites.

VandaTheGod didn’t only target government Web sites, but also launched attacks against public figures, universities, and even hospitals. In one case, he claimed to have access to the medical records of 1 million patients from New Zealand, which were offered for sale for $200.

While the majority of VandaTheGod’s attacks against governments were politically motivated, but closer scrutiny of his tweets shows he was also trying to achieve a personal goal: hacking a total of 5 000 Web sites, a goal that was nearly achieved, with 4 820 records of hacked Web sites linked to him.

The man behind the handle

VandaTheGod’s prominent role in several hacking groups, as well as his love of publicity, meant that he stayed in touch with others in the hacking community via numerous social media accounts, backup accounts in case of takedown, e-mail addresses, Web sites and more. Through the years, this activity left a long trail of information for Check Point to investigate.

For example, the WHOIS record for VandaTheGod.com revealed that the Web site was registered to an individual from Brazil, more specifically from Uberlandia, using the e-mail address fathernazi@gmail.com. In the past, VandaTheGod claimed to be a member of the UGNazi hacking group, and this e-mail address was used to register additional Web sites, such as braziliancyberarmy.com.

This wasn’t the only time the hacker got sloppy and shared details online that gave away valuable information about his identity. Another example, a screenshot that showed the compromised e-mail account of Brazilian actress and TV presenter Myrian Rios also shows an open Facebook tab with the name “Vanda De Assis”, and looking that name up led to a profile belonging to the attacker.

“While this profile did not share any details about the real identity of VandaTheGod, we were able to see many similarities between this and the Twitter accounts operated by the attacker, as the same content was often shared on both platforms,” says Check Point. “What was more interesting, however, was that this screenshot revealed the name of a user that we will identify here only by initials MR.”

At first Check Point was unsure if these were the hackers real initials, but upon further investigation, discovered a first name with these initials also appearing in several screenshots shared in VandaTheGod’s Twitter as the username of the machine used for this hacking activity.

Researchers tried to search Facebook for people named MR, but unsurprisingly, were presented with too many possibilities to fully explore. “Our breakthrough came when we searched for MR in conjunction with the city we previously observed in vandathegod.com’s WHOIS information: “UBERLANDIA”.

This still gave Check Point numerous Facebook profiles, but researchers were able to locate a single account, which contained an uploaded image endorsing the Brazilian Cyber Army. “At this point, we knew that we were on the right track. All that was left for us to do was to connect this individual’s account with one of the known VandaTheGod’s accounts. We were able to locate several cross-posts between the newly discovered profile and Vanda de Assis’s Facebook account,” the researchers say.

Finally, Check Point located shared photos of the same surroundings from different angles, specifically, the poster’s living room. This confirmed that both the MR and VandaTheGod accounts were being controlled by the same person.


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

Transcorp Hotels Delivers Stellar H1 Results, Declares Over ₦1Bn Dividend

Published

on

Kindly share this post

Transcorp Hotels Plc has delivered a stellar performance in the first half of 2025, recording a 60% year-on-year surge in revenue to ₦47.57 billion, up from ₦29.72 billion in H1 2024. Gross profit climbed 71% to ₦36.21 billion, maintaining a strong 76% margin despite inflation and operational headwinds.

The hospitality giant, a subsidiary of Transnational Corporation Plc, also announced an interim dividend payout of ₦1.024 billion — offering ₦0.10 per 50 kobo ordinary share to shareholders.

In a bold move, the company unveiled Nigeria’s largest corporate venue — the 5,000-seat Transcorp Centre — staking its claim as the new leader in event hospitality. Chairman Emmanuel Nnorom described the results as proof of Transcorp Hotels’ transformative strategies and unwavering investor commitment. MD/CEO Uzo Oshogwe attributed the success to relentless execution and a resilient business model.

Transcorp Hotels, renowned for iconic assets like Transcorp Hilton Abuja and its digital platform Aura, says it isn’t just leading Nigeria’s hospitality sector — it’s redefining excellence across Africa.


Kindly share this post
Continue Reading

E-Business

Microsoft Servers Hacked by Chinese Groups

Published

on

Kindly share this post

Chinese “threat actors” have hacked Microsoft’s SharePoint document software servers and targeted the data of the businesses using it, the firm has said.

Microsoft Servers Hacked by Chinese Groups

 

China state-backed Linen Typhoon and Violet Typhoon as well as China-based Storm-2603 were said to have “exploited vulnerabilities” in on-premises SharePoint servers, the kind used by firms, but not in its cloud-based service.

The US tech giant has released security updates in response and has advised all on-premises SharePoint server customers to install them.

“Investigations into other actors also using these exploits are still ongoing,” Microsoft said in a statement.

The firm said it had “high confidence” the hackers would continue to target systems which have not installed its security updates.

It added that it would update its website blog with more information as its investigation continues.

Microsoft said it had observed attacks in which hackers had sent a request to a SharePoint server “enabling the theft of the key material by threat actors”.

Charles Carmakal, chief technology officer at Mandiant Consulting firm, a division of Google Cloud, told reporter, it was “aware of several victims in several different sectors across a number of global geographies”.

Carmakal said it appeared that governments and businesses that use SharePoint on their sites were the primary target.

A number of adversaries who stole material encoded by cryptography were then able to regain ongoing access to the victims’ SharePoint data, he said.

“This was exploited in a very broad way, very opportunistically before a patch was made available. That’s why this is significant,” Carmakal said.

Carmakal said the “China-nexus actor” was deploying techniques similar to previous campaigns associated with Beijing.

Microsoft said Linen Typhoon had “focused on stealing intellectual property, primarily targeting organizations related to government, defence, strategic planning, and human rights” for 13 years.

It added that Violet Typhoon had been “dedicated to espionage”, primarily targeting former government and military staff, non-governmental organizations, think tanks, higher education, the media, the financial sector and the health sector in the US, Europe, and East Asia.

Meanwhile, Storm-2603 was “assessed with medium confidence to be a China-based threat actor”.

 

 

 


Kindly share this post
Continue Reading

E-Business

NIMC Warns Nigerians of Fake NIN Website

Published

on

Kindly share this post

National Identity Management Commission (NIMC) has issued a public warning that it is not associated with NINcard.com.

NIMC Warns Nigerians of Fake NIN Website

According to the commission, the website has been circulating online to offer services for Nigerians seeking National Identification Number (NIN) services.

NIMC, in a post on its official X account on Wednesday, said, “NINcard.com is not in anyway affiliated to NIMC. Stay vigilant!”

The warning was accompanied by screenshots of fake payment receipts and OTP request pages from the website, both of which were boldly stamped “FAKE” by NIMC to alert the public.


Kindly share this post
Continue Reading

Trending