OSINT attribution and deanonymisation

Flare traced TeamPCP's GitHub handle to a HackerOne profile carrying a real name

Australian Federal Police arrested two men over malicious code the agency estimates reached more than 1,000 organisations. What identified the alleged leader was a screen name he kept using on other platforms.