Beyond Usernames

An analysis of the Pamora Linux backdoor sold by a threat actor known as Darkworm, written in C. The investigation goes beyond the malware itself to examine the actor's presence across dark web forums including Spy Hackers, Nulb, Anti-Chat, and Cracked. OSINT techniques using username tracking are discussed, with the caveat that identical usernames across platforms may indicate separate individuals rather than the same actor.