USDoD
USDoD is a Spain-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Defense and Aerospace sector in the United States. It uses 1 MITRE ATT&CK technique.
- NetSec
- ScarFace_TheOne
- Operation “Data Breach”
- Origin
- Spain
- Techniques
- 1
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2020
- Record updated
Who They Target.
About USDoD.
During our Deepweb search in various forums, security researchers at the Lab identified a prolific TA going by the name NetSec aka ScarFace_TheOne aka Scarfac33 and targeting the U.S. infrastructure. Our research indicated that the TA has been active on the forum for over two years, taking part in various cyberattacks with diverse geographical and dynamic industry footprints. The TA’s malicious cyber activities have helped earn an aggressive reputation, besides resulting in the TA being widely endorsed and acclaimed by other notable malicious actors such as Pompompurin, Holistic-K1ller, and IPegFemBoys.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.