Necromancer

•
"IT engineer. Main account: @necomancer_"

•
"IT engineer. Tech, code, and whatever I'm building. Main: @necomancer_"

•
I love my wife

[Necromancer @necromancer3302]

@Nu_scapi20251 @SpringZ_FSG @Mother_Sphere PowerShell*

[Necromancer @necromancer3302]

@Nu_scapi20251 @SpringZ_FSG @Mother_Sphere it literally looks for the exact file size and names that was reported official guide there are even comments for people who don't understand shell very good

[Necromancer @necromancer3302]

@armoregg1 @SpringZ_FSG @Mother_Sphere like litterly its like 22 i wonna go u know zzzzzz and now i need to like say hello to random people on twiter
listen i am making a full video on the whole situation which i will post next week prob about my pov how we worked and how the comunity united and other stuff

[Necromancer @necromancer3302]

@armoregg1 @SpringZ_FSG @Mother_Sphere WHO DEARS TO AWAYKEN ME FROM MY SLUMBER

[Necromancer @necromancer3302]

@PubgOnDeez @whyKusanagi what?

[Springz @SpringZ_FSG]

If you lost something or were harmed, report it yourself too. Don't wait for anyone else.

You can report financial loss, account, data or device damage, or moral and emotional distress. Reporting doesn't establish eligibility for compensation.

1. Tell the game's Customer Support
2. Keep your evidence: dates, screenshots, account alerts, and your original launcher logs (debug.log), unchanged and private. Please don't DM or post them yet, we're reviewing a safe submission process and will announce it publicly if it becomes available.
3. Report to your local police or cybercrime unit

Never send passwords, recovery codes, IDs or keys to anyone, including us.

[Springz @SpringZ_FSG]

Volunteers needed 🛡️

NIKKE launcher incident, Phase 2. Two goals:

→ Ask SHIFT UP & Level Infinite about compensation for real losses, beyond in-game gifts
→ Help players report to the right authorities early, to reduce the risk of data misuse

Right now it's hard to work out who to report to in your own country. We want to put that in one place, country by country.

How you can help:
• you know who to contact in your country (police, cybercrime unit, consumer office)
• you can translate or proofread
• you like checking facts and timelines

Send me a message with what you can do and your country or region.
First drafts about a week after a small team forms. No promises on results.

If you were affected: keep your original launcher logs (debug.log) unchanged and private. Please don't DM or post them yet, we're reviewing a safe submission process and will announce it publicly if it becomes available.
Never send passwords, recovery codes, IDs or keys.

Details and what to do if you were hit: thread below ↓

Community call, not affiliated with SHIFT UP or Level Infinite. We'll announce any official contact method publicly.

[Necromancer @necromancer3302]

@Gabsans3 @SpringZ_FSG if he left a backdoor then yes he could "depends on his code"

[Necromancer @necromancer3302]

i am not saying any thing... But i do 🤙

[Skittles 🪡🧸 @WrathfulSkittlz]

@SpringZ_FSG Honestly, they should hire some people from the community to do stuff like this. I don’t know what their work time is but It would be cool that a select few from the community can help SU find solutions to these situations fast, even while their main team is asleep.

[Springz @SpringZ_FSG]

NIKKE PC launcher incident: the attacker's domain is DOWN. Real good news, and a win for all of us. 🎉

✅ What's done
• The registrar (PublicDomainRegistry) suspended insightjs[.]com, the attacker's domain. I checked it myself in registry and DNS data: a hold since Nov 5, 02:05 GMT, the name servers were swapped, and the name no longer resolves.
• The registrar confirmed by email that it reviewed my abuse report and suspended the domain, about five hours after I sent it. The email is in the picture, cropped.
• The host (1984 ehf) says it shut down the server I reported.

🟢 What it means
• The address the infected scripts loaded the malware from is gone. In theory, the old attack now has no known address left to load from or send data to.
• That helps everyone who hasn't launched the PC launcher yet: the publisher says the current version is safe, and now the attacker's known address is dead too. I'm not telling anyone to rush, so follow the publisher's guidance first.
• It does not clean a PC that already ran the infected launcher. If that's you, use the official manual check: https://t.co/NY1wacMI2H

➡️ What to expect next
• A hold can be lifted, and the attacker can try a new domain or server. The same kind of report works again, and I'll keep watching.
• Not everything is closed yet: I'm still waiting on the host about the rest.
• Law enforcement is a possible next step. I'll ask the registrar and the host to keep their records for investigators.

To the NIKKE team (@NIKKE_en): what I just did, you should have done yourselves from the very start. It was easy: one clear report, about five hours. It only takes speed, and every hour counts for players. Please keep moving fast: report the rest of the infrastructure, tell us if the police are involved, and keep players informed. Thank you for the official scan and guide.

Thank you all for the shares, the evidence and the calm. 🙏

Guide with checks, steps and sources:
https://t.co/fMpxAYHv3w

Follow me and star the repo to get updates.

[Necromancer @necromancer3302]

On the NIKKE launcher incident, and @whyKusanagi’s article: the other side of the story 🧵

I’m the friend Springz asked to check it. Here’s what actually happened.

1. The early post. On Nov 3 Springz stressed that there was no official confirmation, which was true, but he was too dismissive of the independent technical work that was already public. The Community Note on that is fair. The incident was real. So he asked someone to verify it.

2. The verification. He messaged me (I study IT) and asked if it was real or fake. Before running anyone’s scanner, I read its source code first, because running a random “virus checker” during an attack is how you get hacked twice. Then I ran it on my own PC. My launcher logs confirmed the agent was downloaded on Nov 1, 2 and 3. From that moment we treated it as real.

3. Then we went after the infrastructure. The domain in my logs, https://t.co/rmXkR6WQ4Z, pointed to 89.127.233.127, a rented VPS at 1984 ehf in Iceland.

Springz reported it. 1984 confirmed the server was shut down and pointed us to the registrar. Their email: https://t.co/OVhi8tRkFa

He then reported https://t.co/cMc8RtQJYm to PublicDomainRegistry, and they replied that they had reviewed the complaint and suspended the domain (on hold since Nov 5, 02:05 GMT). Their email: https://t.co/oj5ELCIbIf

We also asked both providers to keep their records for law enforcement. Others reported the same infrastructure too, and that’s a good thing. More reports mean faster action.

4. On using AI. Most people working on this, on every side, used AI tools to move faster, and that’s fine. Tools aren’t the question. Results are. The host’s and the registrar’s replies are public in the posts above.

5. Credit where it’s due. MotherSphere’s teardown, whyKusanagi’s check kit and timeline, the NGA player who first found it, and everyone who shared logs and stayed calm. This was never one person’s work.

6. What’s next. I agree that the official teams did a very bad job of guiding the community, and I hope that gets fixed. Our goal now is to unite the community and build one set of clear docs and guides, so law enforcement has every reason to act before the attackers can do anything with what they took.

That’s Phase 2: https://t.co/7AzYhkiTxE

If you played NIKKE on PC in late Oct or early Nov, check your PC with the official guide: https://t.co/pDUInz3ESI
Springz’s guide and sources: https://t.co/5774uO0HvV
My GitHub: https://t.co/EsEEuxFNkq

[Necromancer @necromancer3302]

@PubgOnDeez @whyKusanagi did u see his last post ? there is a link to it in this reply...

[Commander’s Meme Database @DB_Commander]

🚨BREAKING NEWS🚨

Shift Up’s CEO, Hyung-tae Kim, gave a new statement on the origins of the “k2f_chad” line of malware code that appeared within Nikke and many other games that used the same client.