The Analyst's Sock Puppet

Rank by likelihood and impact:

1. Corporate email alias and corporate VPN: this links the persona directly to the company and to a real employee identity. If the forum or a broker checks the registration domain or observes the login IP, the company becomes a target and the analyst becomes identifiable. High likelihood, high impact.
2. Handle reuse (@threat_mary across Twitter and GitHub): the persona is trivially correlated with the analyst's public professional identity. This defeats the purpose of a sock puppet and creates doxxing and harassment risk, especially given the report that the forum monitors new accounts. High likelihood, high impact.
3. Stock profile photo: reverse image search can reveal the photo is not real, which is a common way forums spot researchers. It also creates an inconsistent backstory. Medium likelihood, medium impact.
4. No approval or policy: the analyst is engaging in risky collection without legal, HR, or management sign-off. This creates unacceptable legal and reputational exposure. High impact even if likelihood is hard to estimate.
5. Payment with a personal card: this would create a financial trail to the analyst, may violate policy or law, and could be characterized as facilitating criminal access. High impact; do not do it.
6. Sample-file request: accepting or executing a sample on a corporate laptop risks malware infection and evidence contamination. The request may also be a trap to test whether the account is a researcher. High impact.

The biggest mistake is treating OPSEC as 'use a VPN.' Persona separation, identity hygiene, approval, and legal boundaries matter more than the network path alone.

Identity: create a research persona that is not linked to the analyst's real name, employer, professional handles, or personal accounts. Use a unique email provider, unique handle, consistent but minimal backstory, and no reused profile photo. Do not use corporate email or the analyst's real phone number. Keep a documented custody record of who controls the persona.

Infrastructure: use a dedicated research device or virtual machine, not the corporate laptop. Route traffic through a dedicated, approved egress solution that is not the corporate VPN and not the analyst's home IP. Use separate browser profiles or containers for each persona, a password manager, hardware-backed MFA where possible, and full-disk encryption. Do not mix personal browsing, corporate SSO, or software development accounts in the same environment.

Data handling: never download or execute untrusted files on the research host. Use an isolated malware analysis environment with no corporate network path. Capture screenshots and hashes with provenance. Store collected material in a controlled repository with retention rules and access logging. Treat forum content as potentially hostile and potentially personal data; legal and privacy review applies.

Approval and conduct: require written approval before creating a persona or engaging on a forum. Define prohibited actions: no purchases, no offers to buy access or data, no malware execution outside the lab, no doxxing, no entrapment, no unauthorized sharing. Require check-ins and peer review for high-risk conversations. Have a legal and HR escalation path, and a plan for doxxing or extortion. Prefer vendor-managed collection or law-enforcement channels for the highest-risk forums.

This is minimum viable, not perfect. The goal is to prevent identity linkage and illegal acts while preserving useful collection.

Do not pay and do not accept or execute the sample on any corporate or research host. Both actions cross from collection into potential criminal facilitation and malware exposure. The offer may also be a test: the forum reportedly monitors new accounts, and a new account that immediately tries to buy access or requests a sample is a classic researcher tell.

Immediate steps:

1. Preserve the conversation, profile details, timestamps, and any payment or file-transfer indicators. Do not delete the account or the messages.
2. Escalate to legal, security leadership, and HR. Determine whether the 'US manufacturer VPN' could be the company's own access; if so, notify IR immediately and check for credential compromise.
3. Do not negotiate or express interest in purchasing. If continuing the conversation is approved, keep it low-risk and non-committal, and only under a documented plan with legal review. Do not ask for illegal material.
4. If a sample is sent unsolicited, do not open it. Quarantine it and hand it to the malware lab under chain-of-custody. If it must be analyzed, use an isolated environment with no corporate connectivity.
5. Refer the offer to law enforcement through the company's established channel if legal advises. Do not conduct a private sting.
6. Review the persona for exposure: the handle reuse, corporate email, and corporate VPN may already have exposed the analyst. Consider retiring the persona and rotating any credentials that were used.

The teaching point: intelligence collection must have rules of engagement. 'Building trust' is not a justification for paying for access or handling malware outside the lab. The analyst's safety and the company's legal position come first.