USDoD

USDoD is a cybercriminal threat actor known for high-profile intrusions, data theft, and attempted monetization of stolen datasets through underground forums. The actor is publicly associated with the December 2022 compromise of the FBI-affiliated InfraGard platform, where access was reportedly obtained through social engineering and member data was offered for sale. USDoD later resurfaced in 2023 and 2024 in connection with breaches and leak claims involving Airbus, National Public Data, and other organizations. Reporting also links the actor to claims involving the U.S. Environmental Protection Agency, although in that case the actor later stated the data had been scraped from a third-party source rather than obtained through a direct breach. USDoD is most strongly associated with the 2024 National Public Data incident, in which the actor advertised a massive stolen dataset for sale for millions of dollars and was subsequently named in litigation and bankruptcy filings tied to the breach. The exposed information reportedly included highly sensitive personal data affecting individuals in the United States, United Kingdom, and Canada. The actor’s operations show a pattern of unauthorized access, exfiltration of large datasets, public leak or sale announcements on cybercrime forums, and reputational amplification through high-visibility victim selection. The actor has demonstrated capabilities spanning initial access via social engineering and use of stolen credentials, data exfiltration, post-compromise abuse of third-party access, and public commercialization of stolen information. In the Airbus case, reporting tied the intrusion path to credentials harvested by infostealer malware from a third-party user with access to Airbus systems, indicating operational use of credential theft ecosystems. USDoD has also been described in some reporting as hacktivist, but the most consistently supported behavior is financially motivated cybercrime centered on theft and sale or release of sensitive data. High-confidence reporting identifies the actor as operating from Brazil, and Brazilian Federal Police arrested a suspect publicly linked to the USDoD alias in connection with multiple major breaches. USDoD is not a ransomware operator based on the available facts; the actor is better characterized as a data-theft and leak actor focused on unauthorized access, exfiltration, and monetization of stolen records.