888

888 is a financially motivated cybercriminal and data broker active on cybercrime forums including BreachForums and DarkForums. Based on the provided reporting, the actor is associated with advertising, selling, leaking, or claiming responsibility for multiple large-scale data breaches affecting organizations in several sectors, including space/scientific collaboration, real estate, events, recruitment, betting, and other commercial targets. Known victims mentioned in the content include the European Space Agency (ESA), Ledil Immobilier, DinerEnBlanc.com, CIEE (Centro de Integração Empresa-Escola), ThankQCamping, Samsung Medison, MinasBet, and incidents involving Microsoft and Nokia employee data. The actor has been described as having a credible reputation on the dark web for large-scale data breaches and operating for financial gain. 888 has offered stolen data for sale or publication on forums, including exclusive sales and free-download leaks, and has requested payment in Monero in some cases. Reported exposed data types across incidents include personally identifiable information, employee and customer records, source code from private Bitbucket repositories, CI/CD configurations, API and access tokens, SQL database files, Terraform code, credentials, internal documentation, event-management data, and sensitive cloud-hosted records. Tradecraft explicitly mentioned in the content includes use of cybercrime forums for monetization and disclosure, alleged exploitation of public-facing applications, theft of data from information repositories, exfiltration over web services, and in at least one case access via a compromised third-party service. In the CIEE incident, reporting tied the exposure to a publicly accessible misconfigured Google Cloud Storage bucket. In the ESA case, 888 claimed access to external servers supporting unclassified collaborative engineering activities and posted screenshots as purported proof, though some reporting noted the authenticity of samples had not yet been independently verified at the time. No nation-state attribution is supported by the provided content. No additional aliases or sub-groups for 888 are directly established in the content beyond the actor name itself.