BreachForums

So this group wasn't the most disciplined group.

Now, Austin Larson, a Google Threat Intelligence Group researcher, found a leak of user data from the Breach Forum's hacker forum that one of the most active handles in the canister room chat had been registered to a Google Gmail address, sheepstealing at gmail.com.

So Larson began combing through these other forum archives, and he found a 2019 dispute between someone with the pseudonym Sheepstealing and a seller of pirated Microsoft Office keys, in which the Sheepstealing user demanded a refund at a PayPal account tied to the email ruben at thompsonfamily.net.au.

In the intelligence community, this is what we call a clue.