ModernStealer Threat Actor Linked to Government and Defense Data-Leak Claims

StealthMole analysis links a cluster of dark‑web and Telegram postings to an actor using the ModernStealer label and related aliases (including a recurring Session ID, Tox ID, and Telegram accounts), which advertised alleged military, nuclear, and aerospace documents. The report supplies defanged URLs and identifiers as IoCs, stresses that the claims are unverified, and recommends evidence‑based validation, credential resets, hardened access controls, and monitoring of messaging ecosystems.