One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign

MITRE Techniques

• [T1036 ] Masquerading – The actor used a fake American patriot identity and disguised malicious tools as legitimate crypto software to gain trust (‘the actor used the LLM to impersonate an American veteran patriot’; ‘a “freedom-first, self-custody wallet” called StellarMonster’).
• [T1056.001 ] Keylogging – The remote-access tool enabled clipboard capture, which can expose pasted secrets and wallet seed phrases (‘it gives the actor a persistent remote desktop session with file access, command execution, and clipboard capture’).
• [T1078 ] Valid Accounts – The actor reused stolen Gemini API keys and likely-stolen credentials to access services and automate operations (‘using 73 likely-stolen Gemini API keys’; ‘The actor first tried to reuse a stolen credential’).
• [T1110 ] Brute Force – Gemini was used to model password mutations and generate plausible guesses for WordPress accounts (‘can model the mutations when supplied with static wordlists’; ’20 plausible password variants’).
• [T1219 ] Remote Access Software – The actor repurposed GoToResolve, a legitimate unattended remote-administration tool, for persistent access (‘StellarMonSetup.exe is in fact GoToResolve’).
• [T1059.001 ] PowerShell – The actor used scripts and command execution to automate deployment and infrastructure tasks (‘a set of Python scripts that called Gemini’; ‘command execution’).
• [T1583 ] Acquire Infrastructure – The actor deployed servers, Cloudflare tunnels, a VM in the Netherlands, and other infrastructure to support the operation (‘Gemini deployed servers’; ‘managed the actor’s Cloudflare tunnels’).
• [T1105 ] Ingress Tool Transfer – The actor posted and distributed executables and tooling through the Telegram channel (‘The actor posted an executable, StellarMonSetup.exe, to the channel’).