Researchers Expose Major OPSEC Failures of r1z Initial Access Broker

The arrest of Jordanian national Feras Albashiti, operating under the alias “r1z,” demonstrates how sustained operational security failures can expose entire cybercrime operations.

KELA Cyber Intelligence Center’s comprehensive analysis reveals how the initial access broker’s persistent OPSEC mistakes left attribution trails across multiple platforms, ultimately enabling law enforcement to dismantle his ransomware supply chain operations.

U.S. authorities arrested Albashiti after monitoring his activity on the XSS cybercrime forum, where he operated as an initial access broker selling compromised enterprise network credentials, hacking tools, and advanced malware.

An undercover FBI agent purchased network access and malware capable of disabling multiple endpoint detection and response (EDR) products directly from r1z, enabling investigators to observe his criminal infrastructure firsthand.

The operation ultimately connected r1z’s online persona to Albashiti’s real-world identity, linking his infrastructure to major ransomware attacks.

Following extradition to the United States, Albashiti pleaded guilty to selling unauthorized access to at least 50 companies across the USA, Europe, Mexico, and other regions.

Extensive Cybercrime Activity

KELA’s threat intelligence platform identified approximately 1,600 posts attributed to r1z across multiple cybercrime forums including XSS, Nulled, Altenen, RaidForums, BlackHatWorld, and Exploit.

His last known message appeared on XSS in December 2023, discussing a cracked version of the Cobalt Strike penetration-testing software.

Throughout his activity, r1z advertised access to compromised SonicVPN installations and enterprise networks with remote code execution (RCE) capabilities.

Several posts appeared in Russian on Russian-origin forums, expanding his customer base across language barriers.

The actor consistently promoted an EDR killer tool reportedly effective even against FBI monitoring environments and shared TOX encrypted messaging contact details for secure communication with buyers.

KELA tracked r1z since 2022, leveraging data lake sources to uncover identity-related information in near real-time.

Username searches revealed accounts on RaidForums, Nulled, Doxbin, CrackedTo, BreachForums, and Altenen, associated with two email addresses: gits.systems@gmail.com and cobaltstrike@tutanota.com.

Analysis of the Gmail address revealed its presence in at least 30 compromised databases containing associated passwords, phone numbers, additional usernames, birthdate, and IP addresses linked to non-VPN standard ISP providers based in Jordan.

The email was also listed as the contact for “OrientalSecurity,” a company in Amman, alongside Firas’s full name and phone number.

A Gravatar account registered under his personal name Firas K. Bashiti featured the identical profile picture used by his r1z moniker across multiple forums, with the title “IT Security – Penetration Testing.”

Additional usernames discovered in data leaks included OrientalSecurity, j0rd4n14n, bashiti, j0, f1r4s, and Eddy_BAck0o.

Social Media and Infrastructure

The actor operated a Telegram channel (@secr1z) sharing a TOX address matching those published in forum posts. KELA attempted contact via Telegram (@j0rd4n14n) approximately two years ago, but r1z denied the association, claiming mistaken identity.

Minutes later, he changed his profile photo and username to -j0 and deleted the conversation. However, the unique TOX ID enabled KELA to link the r1z alias with the Telegram account confidently.

Additionally, his Facebook profile, similar to LinkedIn, listed the name “Eddie Bashiti”, likely used as a nickname or an alternative name to reduce discoverability in relation to his cybercriminal activities. 

His website, sec-r1z.com, created in 2009, revealed personal details including the same Gmail address, physical address, and phone number through WHOIS records.

Based on the Gmail address, r1z registered at least 60 websites, predominantly related to IT services in Jordan, mostly through registrar ENOM.

Social media profiles on LinkedIn, Facebook, and YouTube displayed identical photos to his forum profile images. His LinkedIn profile described him as an Information Technology Architect with expertise in cyber threats, cloud, network, and penetration testing.

Notably, the contact section included the URL “linkedin.con/in/r1z,” directly connecting his real-world identity to his threat actor persona.

This case illustrates how threat actor exposure results from consistently poor operational security rather than sophisticated investigative techniques alone.

Despite compartmentalization attempts, r1z repeatedly reused usernames, images, emails, infrastructure, and communication channels across forums, services, and social media platforms, creating a dense and traceable digital footprint.

KELA identified and tracked this actor years before law enforcement action by correlating these signals, demonstrating that sustained OSINT and underground monitoring can expose a threat actor’s complete digital presence and that even experienced cybercriminals frequently undermine themselves through fundamental OPSEC failures.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.