I can't even begin to count the hours of research that went into this story. Frustrated that most of that research went in the wrong direction for so long. But also very excited to share what I found, and that I finally have something to show for it all:
On Dec. 18, 2013, KrebsOnSecurity broke the news that U.S. retail giant Target was battling a wide-ranging computer intrusion that compromised more than 40 million customer payment cards over the previous month. The malware used in the Target breach included the text string “Rescator,” which also was the handle chosen by the cybercriminal who was selling all of the cards stolen from Target customers. Ten years later, KrebsOnSecurity has uncovered new clues about the real-life identity of Rescator.
https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/