Record ID: ANTI-LARP
Handle(s): @skidboss, @compress
Status: Active
First Observed: 2024-08-09 (Based on available records)

ANTILARP is a highly active and technically proficient cyber threat actor, data broker, and tool developer operating primarily within underground Telegram communities. Operating largely as a “one-man army,” ANTILARP specializes in high-value database exfiltration, cryptocurrency-targeted social engineering, and the automation of exploit chains.

The actor is known for integrating advanced artificial intelligence (including jailbroken LLMs like custom-configured DeepSeek and Mistral models) into his workflow to generate exploits, parse massive datasets, and automate network intrusions. His capabilities span web exploitation (SSRF, RCE, auth-bypass), cloud infrastructure compromise (AWS S3, Azure, GCP metadata endpoints), and telecom social engineering (SIM swapping, 2FA bypass). ANTILARP is a prominent vendor of corporate credentials, KYC (Know Your Customer) documents, and cryptocurrency exchange databases.

While the actor frequently employs highly controversial, hyperbolic, and provocative language as part of a carefully maintained online persona, threat intelligence indicates a sophisticated underlying methodology focused on financial gain.

• @antilarp — Primary Telegram handle
• @skidboss — Telegram handle used for business and data brokering
• @compress — Telegram handle used for data brokering and private inquiries
• dongle / [email protected] — Legacy alias and associated contact email
• antifart — Satirical/trolling alias used in community chats

• Independent / Freelance (Self-described “solo operator”)
• Rolls Royce Cashouts (RRC) / DWC (Deal With Caution) Communities (Frequent participant and vendor)
• JCO (Former affiliation; currently engaged in a public dispute with its members)

• 2024-08-09 — First documented activity within the provided dataset.
• 2025-02-15 — Claims successful compromise and exfiltration of the Transak and Fractal KYC engine databases.
• 2025-05-31 — Publicly releases a custom Python-based exploitation tool named “CITRIX_VAMP” for automated Citrix gateway cookie-bleeding.
• 2026-05-06 — Last known activity, actively communicating in underground group chats.

• Transak & Fractal KYC Database Breach
• Widespread Corporate AWS S3 / Cloud Storage Compromises
• Metamask & Ledger User Targeting / Credential Stuffing
• FortiManager / Fortinet Infrastructure Reconnaissance

• Automation & AI Use: ANTILARP demonstrates a strong reliance on automation. He frequently discusses utilizing uncensored LLMs (referred to jokingly as “George Droid Giga-nigger Bot II”) to optimize Python scripts, write malicious payloads, and parse complex JSON/SQL database dumps into sellable leads.
• Social Engineering: The actor claims high proficiency in social engineering (SE), particularly against telecom providers (AT&T, Verizon, T-Mobile) and cryptocurrency exchange support desks. He claims to use voice spoofing and deepfake technology to bypass verification.
• OpSec Observations: ANTILARP claims to use a highly compartmentalized setup involving offshore VMs, custom Ubuntu builds (“FBI CART OS” jokingly), and layered proxy chains (residential and mobile SOCKS5) tailored to match a victim's exact ZIP code to bypass anti-fraud engines.
• Behavioral Profile: The actor routinely uses inflammatory language, aggressive posturing, and shock humor. Analysts note this is likely a deliberate obfuscation tactic to blend into the “com” (underground community) subculture and project an unpredictable, intimidating persona.

Record created: 2026-05-06.