The operator's own tooling logged him. Profero, the Israeli incident response firm founded in 2020 by Omri Segev Moyal and Guy Barnhart-Magen [20], says the sample it recovered in April carried a Discord bot token in plaintext inside the binary [11]. Discord was the malware's primary command channel, with MQTT secondary and Telegram as an optional backup [12]. That gave the responders the attacker's management channel. They logged his working hours, and their monitoring alerted every time he pushed a new build to victims [18]. From there they reached a partial identification of the man and a confirmed identification of some of the victims [23], and took it to the National Cyber Directorate and Israel Police [17].
Profero's first public writeup went up on April 28 [12]. The thread describing the plaintext token came on August 24 [11]. That is 118 days between the two: 2 days left in April, 31 in May, 30 in June, 31 in July, 24 in August [22]. The court order barring publication of the case came off only on Tuesday night, and at his lawyer's request the suspect's name is still withheld [6].
The delivery path is the thinnest part of the public record and the most consequential. Segev Moyal told People and Computers that victims were infected through an endpoint protection component belonging to an Israeli cyber unicorn, which he did not name [15]. Once resident, the malware stole credentials and abused Active Directory [12]. Neither the vendor's identity nor the mechanism by which its component carried the payload is public.
The employment claim also rests on one publisher. People and Computers reports the suspect is a computer expert who worked as an information security man at a large Israeli integration company [2], while Segev Moyal's own phrasing was that the suspect had worked at, or been dismissed from, the integration firm [21]. Investigators say he acted on his own and has no criminal record [5]. The offenses attributed to him so far are under the Computer Law, plus wiretapping and invasion of privacy [4].
Profero says it briefly suspected an Iranian build [14]. Its later read was a developer who was not technically strong, leaning on AI and vibe coding tools [10] and on software associated with gaming [16]. That construction still bought administrative access in several organizations, at a level Profero says could have supported ransomware [19]. Nobody has said publicly whether the integrator's client list overlaps the victim list. Police have already searched several additional companies [8].
