A ransomware operator lives behind a handle, and handles leak. This walkthrough shows how to pivot from one username on one forum to a corroborated profile of an actor, using the selectors people reuse across platforms: usernames, email addresses, PGP fingerprints, cryptocurrency wallets and messaging IDs. The technique is old-school OSINT applied to the cybercrime ecosystem, and its value is not a courtroom unmasking but a defensible link chart that ties aliases, infrastructure and campaigns together.
One discipline up front: this is investigative correlation, not identification. Selectors get shared, spoofed and reused deliberately to poison exactly this kind of analysis. Every pivot is a hypothesis you confirm with a second, independent selector.
What is a selector, and why do they leak?
A selector is any distinctive identifier an actor carries between contexts. Operators are consistent people running a business, and consistency leaks. A forum name gets reused on a paste site. A PGP key used to sign a leak post is the same key on an old marketplace. A Bitcoin donation address in a signature turns up in a breach. Each reuse is a potential edge in a graph. The takedown history of forums like XSS shows how much of this ecosystem runs on persistent, reused identities, which is precisely what makes pivoting work.
How do you pivot on a username?
Start with username enumeration. Tools like WhatsMyName and Sherlock check a handle against hundreds of sites at once, surfacing accounts that reuse the same string. Treat the raw output as leads, not conclusions, because common handles collide across unrelated people. Refine by looking for style markers that travel with the actor: a distinctive spelling, a numeric suffix, a transliteration pattern. When the same unusual handle appears on a criminal forum, a code-sharing site and a gaming profile with matching timestamps and language, you have a thread worth pulling. When it appears on a thousand generic sites, you have noise.
What do PGP keys and emails give you?
PGP is a gift to investigators because operators use it to prove identity to each other. A public key has a fingerprint and, usually, a user ID string with an email. Key servers and cached key dumps let you search a fingerprint and find every context where that exact key was posted, which links personas that otherwise share nothing. Emails pivot the same way: run an address through breach-lookup services such as Have I Been Pwned to confirm it is real and see where it surfaced, and check whether the local part matches a username elsewhere. An email recovered from a signed post or a leaked database is one of the strongest single selectors you can get, precisely because it is hard to fake retroactively.
How do crypto and messaging IDs close the loop?
Cryptocurrency addresses and messaging identifiers are the selectors that connect the online persona to operational activity. A wallet posted in a forum signature can be followed with the methods in our on-chain payment-tracing walkthrough, and if it also appears in a ransom note you have linked a persona to a campaign. Messaging IDs such as Tox, qTox, Session or a Telegram username tie a forum identity to a live negotiation channel. The strongest cases stack independent selector types: a username that matches an email that signs a PGP key that appears next to a wallet that received a ransom payment. That stacking is what separates a hunch from a link chart you would defend.
How do you avoid fooling yourself?
The failure mode of persona OSINT is confirmation bias dressed as a graph. Actors seed false selectors, borrow handles, and impersonate rivals to misdirect exactly this analysis. Guard against it by weighting selectors, as the chart above suggests: a PGP fingerprint or a breach-confirmed email is worth far more than a common username, and writing-style similarity is a supporting signal only. Keep every link sourced and timestamped, record contradicting evidence as loudly as confirming evidence, and state a confidence level for each edge in your chart. Maltego is the standard canvas for holding all of this together, but the discipline matters more than the tool. If your whole cluster rests on one reused handle, you do not have a cluster, you have a guess.
Frequently asked questions
What tools find accounts reusing a username?
WhatsMyName and Sherlock are the common open-source options; both check a handle against hundreds of sites. Treat their output as leads to verify, since common usernames collide across unrelated people.
Why is a PGP fingerprint such a strong selector?
A PGP fingerprint is highly unique and operators use the same key across contexts to prove identity to peers. Searching a fingerprint on key servers can link personas that otherwise share no visible details, and it is hard to fake after the fact.
Can OSINT alone unmask a ransomware operator?
Rarely. OSINT pivoting builds a corroborated link chart between aliases, infrastructure and campaigns, but turning that into a real identity usually needs non-public data, such as exchange KYC records or law-enforcement legal process.
How do you avoid false positives when pivoting?
Require at least two independent selectors before linking personas, weight strong selectors like PGP keys and breach-confirmed emails above weak ones like common usernames, and treat writing style as supporting evidence only. Document sources, timestamps and confidence for every edge.
Is username and email OSINT legal?
Searching public sources and lawfully accessible breach-notification services is generally legal, but rules vary by jurisdiction and purpose. Stay within terms of service and local law, and if the work supports a case, follow your organisation’s legal guidance.