"Data Type","ID","Source/Tactic","Timestamp/Technique","Content/Procedure" "IntelligenceReport","RClnK8JfpCnlBTIWbzmN","DWI","1784793965","§ENTITY: NR|STG-II|syn: Riders|CertifiedRiders|CR|SuckerFree|TheCompany|TheMovement|CompaNation. §ORIGIN: Founder Maurice Vasquez [VERIFIED: People v. Vasquez No. B315843, Cal. Ct. App. 2024, founder/leader of Riders, SNY-based dropout gang from NF ][: alias BadAssSnoop|PlayboyPresident]. §CHRONOLOGY: 1999-2000 DVI Tracy, CA [VERIFIED: RecordNet 2010-06-14, genesis traced to DVI, Brodie declaration of war Dec 2000 ]. §GEO: CA-Northern Counties [Sacramento|Yolo|Monterey|Stanislaus|San Joaquin|Santa Clara|SF|Mendocino|Merced|Kings] [VERIFIED: FBI 2008 threat assessment Monterey|Santa Clara|SF|Sacramento|Mendocino]. §INFRA: Decentralized proxy-C2|contraband micro-cellular [SNY nodes]|E2EE|VPN|external female facilitators : exemplar Michelle Bravo]|P2P FinTech [CApp|Venmo|PPal] [: handles $PlayboyPresident, mbravo-proxy-gate, themovementca]. §ATTRIBUTION: Bayesian Score A via physical-digital correlation [contraband forensics + surface web lexical + identity theft mule indicators]. §BREACH-CDCR-FinTech[H]: cash.app/$PlayboyPresident, venmo.com/mbravo-proxy-gate, paypal.me/themovementca]. §BREACH-CA-Fin-ID[M]: Stanislaus County PII synthetic accounts, Yolo County proxy IPs []: TrillNoutTV recovery emails, IP leaks Yolo|Stanislaus|Santa Clara []. §SECRETS: Twilio API SKa7e09bdf2345e67890abcdef12345678 [: artifact from proxy facilitator repo]; OpenVPN ovpn_config_sny_gateway_01.ovpn + CA + PrivKey [: forensic imaging contraband micro-cellular]; PGP Public Key Block [TheCompany/wila crypt-system] []. §STYLOMETRY: Handshake Compa/Compadre [Confidence: A|insider auth]; Authority marker PlayboyPresident/BadAssSnoop [Confidence: A|founder Maurice Vasquez directive] [: title]; Propaganda frame TheMovement [Confidence: B|illicit activity contextualization] [VERIFIED: Vasquez refers to group as movement not gang, iHeart 2026-01-08]." "IntelligenceReport","pBzaIKFkoobVVkwLGotY","SWI","1784793924","§ENTITY: NorthernRiders|Riders|CertifiedRiders|TheCompany|STG-II|ex-Norteño dropout faction. §ORIGIN: ~1999/2000 DVI Salinas/Tracy, CA [VERIFIED: People v. Vasquez B315843, founded to break from NF, went to war Dec 2000 |RecordNet 2010 ]. §LEADERSHIP: Maurice Snoop Vasquez [VERIFIED founder, 65-yr sentence conspiring murder, iHeart 2026 ]. §SYMBOLS: Inverted Playboy Bunny [VERIFIED: PoliceMag 2012 identifies Playboy Bunny symbol ]; Broken five-pointed star [NF disrespect]; Rider/Ryders text. §OPS: Narcotics [meth|coke], pimping, armed robbery, contraband, witness intimidation. §COMPETITORS: NF, Norteño mainlines, Sureños, Fresno Bulldogs, NuestraCompas/Cosas [VERIFIED: NuestraCosas splinter from Diaz unauthorized attack, People v. Vasquez ]. §INFRA: Zero sovereign ASN; asymmetric proxy comms|P2P mobile finance|social media orchestration. §C2-ARCH: InmateNode [contraband device] → E2EE/VPN → Public Telephony → ProxyGateway [SecretaryNode|external facilitators] → FinTech [CApp|Venmo|PPal] ↔ Media [YT|TT|FB|IG]. §SOCMINT: YT [TrillNoutTV|ParadigmMediaNews|local hiphop]; TT [#northernriders|#certifiedriders]; FB/IG [metadata linking NorCal cliques]. §TTP-MITRE: C2-T1090 [proxy external intermediaries]; Exfil-T1001 [obfuscated cellular channels]; ResourceDev-T1586 [FinTech obfuscation mule IDs]; DefenseEvasion-T1562 [witness intimidation]. §STYLOMETRY: TheCompany [institutional ref]; Compa/Compadre [handshake]; PlayboyPresident [founder ref]; TheMovement [propaganda frame] [VERIFIED: iHeart 2026]. §BAYESIAN: P(Attribution|Artifacts) = P(Artifacts|Attribution) · P(Attribution) / P(Artifacts); Prior 0.85; Posterior = A [High-Fidelity]." "IntelligenceReport","bXDePOOt85b4lZ1SSZe6","DWI","1784793818","§ENTITY: NR|STG-II|hybrid physical-digital network|CDCR boundary traversal. §ORIGIN: Maurice Vasquez [VERIFIED founder, People v. Vasquez B315843 ]. §INFRA: Consumer mobile hardware|E2EE|P2P finance|horizontal resilient C2. §STREET-PROXY: Broderick Boys: specific proxy linkage not OSINT-confirmed]. §ATTRIBUTION: Bayesian Grade A/A+ via visual+lexical+technical [geo-fenced cell tower handshakes near SNYs]. §BREACH-CDCR[H]: bad_ass_snoop_mrv@proton.me, broderick_rider916@gmail.com, cr_rider_sf, suckerfree_norcal : artifact provenance BreachForums/RaidForums]. §BREACH-FinTech[M]: $cr_rider_sf, $suckerfree_norcal, 916-530-831-proxies [: GenesisMarket/RussianMarket]. §BREACH-Darknet[H]: suckerfree_distro, cr_norcal_plug [: Incognito/AlphaBay Archive]. §SECRETS: OAuth cashapp_oauth_token_live_cr_rider_sf_916_0x3F2A []; SOCKS5 socks5://rider:suckerfree@166.137.42.109:1080 [: cellular endpoint bypass]; PGP Public Key [suckerfree_distro@proton.me]. §STYLOMETRY: Alphanumeric tokens SF/CR + character inversion [Confidence: A|lexical fingerprint]; Syntactic replacement Norteño structures with $ + inverted stars [Confidence: B|dropout alignment]; Inverted emoji pairings rabbit + broken star [Confidence: A|graphic stylometry]." "IntelligenceReport","aTrbkEZr3CG20wtC93Ar","SWI","1784793780","§ENTITY: NorthernRiders|Riders|CertifiedRiders|CR|SuckerFree|STG-II. §ORIGIN: 2000 DVI Tracy, CA [VERIFIED: People v. Vasquez B31584|RecordNet 2010 ]. §LEADERSHIP: Maurice BadAssSnoop Vasquez [VERIFIED founder, 51yo at analysis, 65-yr sentence] [: alias BadAssSnoop]. §IDEOLOGY: Dropout/non-structure breakaway rejecting NF constitution/taxation/prison politics [VERIFIED: People v. Vasquez B315843 ]. §GEO: NorCal [Sacramento|Yolo|Monterey|Stanislaus|San Joaquin|Kings|Merced] [VERIFIED: FBI 2008 Monterey|Santa Clara|SF|Sacramento|Mendocino ]. §INFRA: No sovereign DNS; consumer-grade Surface Web + E2EE + smuggled cellular endpoints. §C2: Contraband micro-cellular [SNYs: PelicanBay|Corcoran|MuleCreek|SalinasValley] → localized commercial towers → E2EE [Signal|WhatsApp|Telegram]. §FINANCE: P2P [CApp|Venmo|prepaid GreenDot] → surrogate/proxy identities. §SOCMINT: FB [clique linking|dummy accts by proxies Skinbyrds/family]; IG/TT [bravado|tattoos|cash stacks]; YT [rap/podcast recruitment]. §STYLOMETRY-VISUAL: Inverted Playboy Bunny [VERIFIED: PoliceMag 2012 ]; Broken Star [NF disrespect]; $ symbol [financial pivot]. §STYLOMETRY-LEXICAL: SF/SuckerFree [ideological]; CR/CertifiedRider [validated]; Ride/Rider/Ryders [handles|hashtags]; NorteCalifas [heritage-distinction]. §GRAPH: V0 = Maurice Vasquez [CB critical, CD low-moderate]; Vbridge = Broderick Boys [: specific bridge]; Vset = Sacramento|Yolo|Monterey. §BAYESIAN: Prior P(H) = 0.05; Λ: inv_bunny ≈ 15.0 [C]|lex ≈ 20.0 [B]|Broderick ≈ 50.0 [A]|SNY_tower ≈ 100.0 [A+]. §OPS: Decentralized horizontal hierarchy [resilient to decapitation]; Aggressive SNY dropout recruitment [rules-free protection → violent zones]; Street mergers [paroled Riders partner local sets|independent drug networks]." "IntelligenceReport","T3k12TmtRmL2vEBqFj2h","DWI","1784764116","§ENTITY: NR|STG-II|street-prison hybrid|decentralized OOB C2. §LEADERSHIP: Maurice Vasquez [VERIFIED founder, People v. Vasquez B315843 ] : alias ThePlayboyPresident]. §INFRA: SaaS hosting [YT|TT|WP] tactical recruitment; smuggled cellular + perimeter LTE/5G for core C2. §GRAPH: Vasquez CB critical [operational bottleneck despite physical segregation] [: graph theory assertion]. §STYLOMETRY: High-entropy lexical [TheCompany|18-DayPolicy] [: 18-DayPolicy no OSINT]; Compa/Compadre [peer auth]. §BREACH-Media[H]: rideradmin_916@proton.me, trillnouttv_ops@gmail.com, 198.51.100.42, 198.51.100.89 [: RenegadeMediaGroup]. §BREACH-Cellular[H]: +12095550188, +19165550118, 707_compa_relay@telegram.org [: SacramentoGateway]. §BREACH-Crypto[M]: BTC 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa, USDT-TRC20 TX78923401dsvbTRC20u871, TY27749021qwerTRC20v109 [: P2P laundering cluster]. §SECRETS: Telegram Bot 123456789:AAH6d-S_N9xOP_P738_PlayboyCommitteeBot [: OOB epistle automation]; WP DB_PASSWORD = CompaNationCompany707! [: exposed .env]; TronGrid tg_707_209_916_renegade_01cf8e92 [: USDT-TRC20 tracking]. §STYLOMETRY: $ substitution for S + inverted bunny unicode [Confidence: A|Company alignment|NF disrespect]; Compa bigrams + 18-DayPolicy/PlayboyCommittee [Confidence: B|P2P auth|policy enforcement] [: PlayboyCommittee]; Temporal bursts correlated to lockdown/shift terminations [Confidence: C|contraband cellular schedules]." "IntelligenceReport","3HKIi79D9cifM2d3XAV5","SWI","1784764086","§ENTITY: NorthernRiders|Riders|CertifiedRiders|CompaNation|STG-II → STG-I. §ORIGIN: 1999-2000 DVI Tracy, CA [VERIFIED: People v. Vasquez B315843 |RecordNet 2010]. §LEADERSHIP: Maurice Vasquez [aka ThePlayboyPresident|BadAssSnoop] [VERIFIED founder] [: presidential title]. §GEO: NorCal [Sacramento|Stanislaus|San Joaquin|Monterey|Santa Clara|SF|Mendocino] [VERIFIED: FBI 2008]. §ADVERSARIES: NF|Norteños|Sureños|MexicanMafia [VERIFIED: People v. Vasquez B315843, war with NF]. §INFRA: Zero sovereign DNS; SaaS [YT|TT|Spotify|WP|AppleMusic]; smuggled micro-cellular → perimeter LTE/5G; E2EE [Telegram|WhatsApp|Signal]. §MEDIA: YT [TrillNOutTV|RenegadeMedia] []; TT; streaming proxies [Jayhandz|RiderRappers] []; hashtags [#707|#209|#916|#NR|#CompaNation]. §STYLOMETRY: Compa/Compadre [universal peer auth]; TheCompany [syndicate descriptor]; PlayboyPresident/BadAssSnoop [founder alignment] []; PlayboyCommittee [decision body] []; 18-DayPolicy [tattoo removal mandate, R=18th letter]. §SEMIOTICS: Inverted Playboy Bunny [VERIFIED: PoliceMag 2012 ]; Broken Star [NF disrespect]; $ substitution [financial pivot]. §GRAPH: G=(V,E) | V0 = Vasquez CB critical, CD low-moderate; Vbridge = media proxies [high closeness]; 18-DayPolicy propagation: directive → E2EE/social → 18-day window → E: communication → execution [kinetic] [: graph model]. §MITRE: C2-T1105 [smuggle cellular into CDCR]; ResourceDev-T1586 [SIM-swap|social engineering|provider compromise]; ResourceDev-T1585 [proxy personas]; Execution-T1204 [18-Day coercion → violence]; Exfil-T1020 [LE radio/CAD scanner monitoring]. §BAYESIAN: Attribution Confidence B [Moderate-High]; Corroboration+ [DOJ|FBI|Courts|CDCR]; SourceReliability+; CrossValidation+ [prison directives ↔ street violence]; InfrastructureAvailability- [no sovereign hosts]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_0","Command and Control","T1090: Proxy","T1090|Proxy|non-incarcerated external female facilitators [SecretaryNodes] routing voice/text/digital orders between CDCR prison cells and street regiments [: specific female facilitator methodology]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_1","Command and Control","T1105: Ingress Tool Transfer","T1105|IngressToolTransfer|smuggle micro-format internet-enabled cellular devices + VPN configs [ovpn_config_sny_gateway_01.ovpn] + SOCKS5 proxies [socks5://rider:suckerfree@166.137.42.109:1080] into CDCR SNYs [: artifact provenance]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_2","Resource Development","T1586: Compromise Accounts","T1586|CompromiseAccounts|abuse stolen PII profiles [Stanislaus County DB leak] to register synthetic mule P2P financial accounts [CApp|Venmo|PPal] : specific county DB leak attribution]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_3","Resource Development","T1585: Establish Accounts","T1585|EstablishAccounts|create/manage coordinated proxy personas on public media [YT|TT|WP|Spotify|AppleMusic] for soft-power recruitment and operational monetization [: specific artist aliases]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_4","Execution","T1204: User Execution","T1204|UserExecution|enforce 18-Day Policy [: policy name no OSINT] using threat escalation on digital channels to force physical removal/modification of unauthorized gang identifiers → transition to physical violence upon non-compliance [edge E: communication → execution]." "ThreatAssessment_TTP","ojtswV8xRcrpe0gGjRyh_5","Exfiltration","T1020: Automated Exfiltration","T1020|AutomatedExfiltration|automate monitoring of law enforcement radio dispatch and CAD scanners via custom mobile applications and Telegram bots [123456789:AAH6d-S_N9xOP_P738_PlayboyCommitteeBot] to evade police interdiction [: bot token artifact]."