---
title: Cybersecurity firm expands investigation into financial sector hacking suspects, linking Telegram, GitHub, and malware records
url: https://www.dataloco.com/en/cybersecurity-firm-expands-investigation-into-financial-sector-hacking-suspects-linking-telegram-github-and-malware-records
published: 2026-10-12T17:21:18+00:00
language: en
section: Security
source: https://www.dailysecu.com/news/articleView.html?idxno=208814
organizations: StealthMole, YY520CN
publisher: Dataloco
---

# Cybersecurity firm expands investigation into financial sector hacking suspects, linking Telegram, GitHub, and malware records

Cyber threat intelligence company StealthMole has expanded its investigation into suspects linked to recent hacking incidents in the domestic financial sector. The firm broadened its scope from a single Telegram account to the entire Chinese-speaking cybercrime community where that account was active. This expansion allowed the company to analyze the roles and activities of 19 accounts, including community administrators and members. By connecting specific member accounts to GitHub profiles and past information-stealing malware infection records, the firm secured concrete identity tracking clues, including two phone numbers and three IP addresses.

The investigation, detailed in a report dated October 9, serves as a follow-up to previous analyses of the Telegram account YY520CN. Earlier reports indicated that this account operated within a Chinese-speaking distributed denial of service attack community for approximately 28 months. During that period, the account was involved in promoting attack services, selling anonymous servers, and supporting overseas users. The current analysis differs from prior work by focusing on the roles and online identities of members who operated alongside the primary suspect, rather than just the individual activities of that suspect.

StealthMole utilized its proprietary Telegram tracking platform to analyze an administrative notice from the GodNet and VITAS communities dated September 26, 2024. After excluding duplicate accounts, the investigation identified 19 distinct accounts, comprising 17 general accounts and two automation bots. YY520CN was identified as a community supervisor, while other accounts held roles such as official operators, managers, volunteers, and advertising staff. The firm conducted additional investigations on the 18 accounts excluding YY520CN, selecting the account HangHang2017 for in-depth analysis. Identification records were confirmed in 15 of the remaining 17 accounts, while no relevant records were found for two accounts.

Analysis of member activities revealed connections between automation bots that processed attack requests and purchase consultation accounts. The firm also observed advertising and consultation activities for various services, including high-defense servers, content delivery networks, proxy servers, cloud resources, and virtual card customer support. Specifically, 131 messages related to attack requests and responses were found in the community's attack bot, AZxhdGodbot. These records contained information about attack targets and methods, and a separate account, xhdvitas, was repeatedly directed as the purchase consultation channel. This evidence indicates that attack-related services and consultation channels were connected within the community, although the success of actual attacks or the identities of service operators have not been confirmed.

The in-depth tracking of the HangHang2017 account, registered as a community volunteer, yielded significant findings. StealthMole analyzed 20 Telegram profile history entries from April 2024 to May 2025, identifying two associated phone numbers. Using its dark web tracking platform, the firm investigated program source code and developer information published on GitHub. A GitHub account named oswaldlow was found to host a service named DemonSword, which directly listed HangHang2017 as a contact. The same author name appeared in source code modification records in a separate repository, and the GitHub profile also displayed the same Telegram contact. While these repeated contacts and author information confirm a connection between the Telegram account and development activities, it remains to be verified whether the same individual manages both.

Cross-referencing the GitHub account information with the firm's compromised data set platform revealed three information-stealing malware infection records from November 2021, May 2022, and February 2023. These records contained authentication information and IP addresses for the relevant accounts, along with data related to RedLine and Raccoon malware. Observed details included Microsoft and Oracle Cloud accounts, Windows usernames, and OneDrive storage paths. This analysis secured three IP addresses from the relevant accounts across different time periods. These IP addresses are observational data from past malware records and have not been confirmed as the IP addresses of the PC used in the recent financial sector attacks or as the attack origin. It is also undetermined whether the three records originated from the same PC or different devices.

The investigation also found that authentication information for the relevant accounts was repeatedly shared via Telegram. Between April 15, 2023, and September 27, 2026, at least 101 files containing relevant account information were found in collected Telegram data. These files were classified as combo files containing user accounts and passwords, and ULP files containing website addresses and login information. This number represents the observed count of files containing leaked information, not the number of independent hacking incidents or pieces of evidence. While the firm confirmed that the authentication information was redistributed over a long period through multiple channels, the original source of the information theft and the current validity of the account information have not been verified. Additionally, addresses recorded as being used for server management, network attached storage, proxies, and image hosting under related domains were identified. Records were also found showing that a proxy installation script's functionality was modified under the name of a developer linked to the account. These materials can be used as evidence to track technical activities and infrastructure associated with the account, but they do not directly prove the actual operation or ownership of the servers.

The core of this follow-up analysis is the expansion of tracking from a single account related to financial sector hacking to the community's operational structure, other members' online activities, and past leaked information. The cross-analysis of Telegram activity records, GitHub developer information, and past malware infection records secured additional identification clues that were difficult to determine using only usernames. However, the materials secured so far only show the connection between accounts and activities recorded on the platforms. The legal identity, nationality, or residence of the actual account operators has not been confirmed. Crucially, no evidence has been found that community members, including HangHang2017, directly participated in or conspired in the recent financial sector hacking. The fact that they operated in the same community as YY520CN does not definitively make them members of a joint attack organization. Law enforcement agencies can use these findings to verify the identity of account operators and their involvement in the attacks by obtaining communication subscription information, access records, and device identification information through legal procedures. This investigation represents a case where the scope of tracking was expanded beyond analyzing AI tools and attack paths used in financial sector hacking to identify the past communities and connections of the relevant accounts. A StealthMole representative stated that the significance of this investigation lies in expanding the tracking scope from the individual activities of the suspect YY520CN to the 19 accounts of the linked Chinese-speaking DDoS community's administrators and members. The representative emphasized that the secured clues, including phone numbers and IP addresses, will be important for law enforcement to verify the identity of account operators and their connection to the attacks, while noting that community membership alone does not prove participation in the financial sector hacking.