- A Singaporean cybercriminal, 39, known by many aliases, was taken into custody in Bangkok for the breach of 13TB of corporate data.
- The hacker used SQL injections and poor RDP connections to attack more than 90 international organizations in the sectors of health care, finance, and logistics.
- The police found and confiscated laptops, storage devices, and luxury goods worth over 10 million baht after following the online identities of the suspect through international cooperation.
Combined operations of police forces from Singapore and Thailand led to the arrest of a 39-year-old suspect in Bangkok. The arrested man was behind 90 large scale data breaches in different countries across the globe.
His illegal network activities compromised more than 13 terabytes of sensitive personal records. Operating under online handles like ALTDOS, DESORDEN, GHOSTR, and 0mid16B, he targeted organizations globally.
How the Cybercriminal Operates and Extorts Targets
The cybercriminal deployed sophisticated intrusion routines to breach vulnerable corporate targets. He used specialized software tools like sqlmap to execute dangerous SQL injection attacks against corporate databases.
Additionally, he exploited weak Remote Desktop Protocol servers to secure initial entry into victim networks. Once inside, he utilized cracked versions of Cobalt Strike software to maintain persistence on compromised systems.
His main objective focused on financial extortion rather than simple system disruption. Instead of immediately releasing stolen data on dark web forums, he tipped off news reporters and data protection regulators. Consequently, this tactic maximized public shame and financial pressure on compromised firms.
At times, he even contacted those who were directly affected through instant messaging services. The goal behind doing so was to force company leaders into giving in and paying ransom.
The hacker also encrypts corporate data in a way that maximally forces company management teams to do what he wants. His adaptability across constantly evolving aliases made him uniquely disruptive within the global cybercrime ecosystem.
Breakdown of Global Targets and Affected Industries
A wide array of commercial businesses suffered through the activities of the hacker. The offender targeted numerous healthcare providers, retail businesses, banks, and suppliers, as well as insurance agencies and recruitment firms. He also compromised insurance brokerages and recruitment agencies during his multi-year campaign.
Location-wise, the greater part of his efforts focused on Asia-Pacific countries. Thai and Singaporean companies and those from Indonesia and India received more hits from his operations. Nevertheless, the hacker did not limit his attacks to these countries; he also struck at targets in Canada, the UK, and the US as well.
This case is part of a broader law enforcement push against dark web crime in the region. In March 2026, Australian authorities charged a 38-year-old man in Sydney as part of a Strike Force Carieville investigation into a dark web drug syndicate that allegedly sold over $80 million worth of prohibited drugs over eight years, with police seizing electronic devices and $35,000 in cash.
Investigations revealed that Thailand recorded the highest concentration of security incidents, suffering 21 distinct breaches. Singapore followed closely, recording 14 documented cyber intrusions.
Eventually, his aggressive operations expanded into Middle Eastern commercial sectors. His targeting expanded steadily over time. He initially focused on Thai companies before moving across Southeast Asian nations. Two years ago, he was actively breaching Western organizations under entirely new aliases.
Joint Investigation and Bangkok Residence Arrest
Singapore Police Force officers opened formal investigations into his operations several years ago. Local authorities received extortion complaints from 11 victimized firms. Investigators tracked the suspect across multiple digital personas that linked back to a single operator.
Tracking the individual proved challenging because he constantly discarded older identities. Nevertheless, digital forensics teams at Group-IB analyzed his writing style and forum posting habits to establish clear connections. A critical breakthrough occurred when officers traced an active X account linked to his 0mid16B alias.
The Cybercrime Command of Singapore and the Central Investigations Bureau of Thailand worked together to conduct a raid at the address of the suspect in Bangkok, where police discovered that the suspect had lived in Thailand without a valid visa. Upon interrogation, he admitted writing a custom exploit code that allowed him to infiltrate corporate servers.
In a coordinated effort by their respective forces, international enforcement teams made a breakthrough. The Thai authorities executed the search warrant at the Ramkhamhaeng address of the suspect. The physical evidence collected on site clearly linked him to his infamous online handles.
Criminal Career Timeline and Asset Seizures
The hacker originally built a strong reputation on subterranean cybercrime marketplaces. His vast collection of exclusive corporate data allowed him to command premium prices. However, administrators banned him from top forums after discovering his scamming schemes and duplicate accounts.
Therefore, he pivoted to new geographic markets to mask his online origin. He operated as Chaoscc and ALTDOS before transitioning to DESORDEN in late 2021. Afterwards, he adopted the GHOSTR moniker before creating his final persona, 0mid16B.
During the Bangkok raid, officers confiscated high-tech electronics and expensive Chanel handbags, watches, and designer jewelry – with the total value of items exceeding 10 million baht, or approximately $300,000. Additionally, he confessed that scam networks from China that are highly active in the Southeast Asia region buy his stolen data batches regularly.
The importance of international police cooperation in dealing with transnational cybercrime has remained a major emphasis from law enforcement agencies, including Interpol. This case indicates the increasing sophistication of cybercrime operations in the region.
The ability of the suspect to escape detection via changes in his identity indicates the magnitude of the challenges law enforcement agencies face. However, his arrest shows the true effectiveness of international security partnerships.
