Source profile

blog.deception.pro

Evidence-bounded context

A field appears only when the current profile revision carries supporting evidence. Missing context stays visibly unknown.

Source classes: Not yet evidenced
Ownership: Not yet evidenced
Funding ties: Not yet evidenced
Declared affiliations: Not yet evidenced
Geographic base: Not yet evidenced
Methodology: Not yet evidenced

Current clusters

security1 distinct publisher

Deception.Pro logged an operator pairing hands-on ScreenConnect with XLoader in one 54-hour chain

Trinity Cyber's deception workstation caught the same operator installing ScreenConnect from a batch file, reaching into LSASS by hand, then dropping FormBook into a signed binary. Two detection teams usually own those halves separately.

Publishers:blog.deception.pro

Reality

Evidence62
Adoption14