xplfinder

xplfinder is an online handle associated with the Pioneer Kitten cluster, used on cybercriminal forums in connection with network access brokering and vulnerability exploitation services. The handle was identified by researchers and US government agencies in connection with the same Iranian IRGC-linked actors operating as Br0k3r and the broader Pioneer Kitten cluster. Like the Br0k3r persona, xplfinder activity reflects the group's cybercriminal-facing operations selling exploited network access to ransomware affiliates, documented in the FBI and CISA's August 2024 advisory on Iranian state-sponsored ransomware enablement activity.