Doxed: how Sabu was outed by former Anons long before his arrest

 When the FBI arrested LulzSec leader Hector "Sabu" Monsegur, they did so in a hurry—hours before the arrest, Sabu was doxed, his identity posted to the Internet. With his name public, federal agents feared that he would start destroying evidence to protect himself, so they ended their covert surveillance and moved in, according to Fox News.


Efforts to name and shame the LulzSec crew during its 50-day rampage were common. Many of these doxings were inaccurate, a result of faulty inferences or deliberate attempts to mislead on the part of the LulzSec hackers.
But not all were wrong. In fact, the game of doxing Sabu was over before it had even started. He was correctly doxed more than two months before his arrest—in fact, more than a month before LulzSec had even started publicly operating.
This first doxing happened after a group of former Anonymous members, displeased at the moralizing direction that Anonymous had taken and at Sabu's leadership role, decided to take action. Speaking to Gawker almost one year ago, the dissident group calling itself Backtrace Security announced that it was going to post chat transcripts and information about the identies of Anonymous members.

Several days later, it followed through on its promise, releasing IRC logs called "consequences.pdf"
(MD5 checksum: a4084efa1713447d295919b4670769da) and a file called"namshub.pdf" (MD5 checksum: 042a645a1bf4cdfb433887424455234e)
that showed a spreadsheet of online names, real names, locations, and other evidence about Anonymous members. (The files have now been pulled, allegedly at the "request of the Federal Bureau of Investigation.") 

While at least some of the information in namshub.pdf is incorrect—subsequent arrests have established the real identities of Topiary and Kayla, and they don't match Backtrace's claims—one name stands out. Sabu is identified as "Hector Xavier Montsegur." This is slightly misspelled, but it's the right name nonetheless. The document also claimed, correctly, that Sabu lives on New York City's Lower East Side.
The PDFs garnered some attention at the time—they even resulted in Backtrace Security being doxed—but apparently not enough attention to force the FBI's hand.
Backtrace then decided to out Sabu again. Early in the evening of June 7, the day of Sabu's arrest, the Twitter account belonging to Backtrace Security wrote: "Hector Xavier Montsegur -aka Xavier de Leon - aka (Sabu)." The same misspelling, but the same correct name.
Read the full article at the source


Published by:

CWZ's picture

Reza Rafati

I am the founder of and I focus on sharing and collecting relevant cyberconflict news., The goal of Cyberwarzone is to provide the world a portal with global cyberwar information. The effort in getting this cyberwarfare information is hard. But as the internet is growing we need to get an global cyberwar & cybercrime monitoring system., By the people and for the people. We will be gathering information about Cybercrime, Cyberwarfare and hacking. LinkedIn:

The Netherlands

My website