Operation Black Hole - Forensic Dossier

Multi-App Fraud Network Investigation

Case ID: OBH-2025-CST-001 Analyst: Sulaiman Alshammari - GraTech Forensic Division Date: April 2026 Methodology: OSINT + Authorized Digital Forensics (ISO 27037, NIST SP 800-86)

DISCLAIMER: This is a public forensic research portfolio. All sensitive values (credentials, wallet addresses, API keys) have been REDACTED. This material is prepared for submission to the Communications, Space & Technology Commission (CST) of Saudi Arabia. No unauthorized access or exploitation was performed. All evidence was collected via OSINT and authorized methods only.

Executive Summary

This repository documents Operation Black Hole, an investigation into a multi-publisher, multi-jurisdiction network of voice chat/gifting applications that share infrastructure, developer identities, and financial pipelines.

The investigation identified 5 applications (high confidence) and 1 additional application (medium confidence) operating as a single coordinated network under different publisher names across Hong Kong, Singapore, and Shenzhen.

Key Findings

Application Attribution (by confidence level)

iOS Publisher (shared): Shenzhen Yinguo Network Technology Co., Ltd. publishes Falla Lite, TooFun, Taeal, and JoyMi under one account.

Attribution Criteria

Apps are linked based on: publisher identity match, package ID prefix patterns (com.iyinguo.*), shared developer email addresses, shared physical addresses, and shared iOS publisher accounts. See analysis/app-attribution-matrix.md for full details.

Infrastructure

• Operations Triangle: Dubai (financial gateway) → Singapore (legal shell) → China (tech core)
• Hosting: Tencent Cloud, AS139341 (ACE-SG), Collyer Quay, Singapore
• Admin Panel: /fallaadmin endpoint discovered via FFUF (47+ hidden endpoints)
• Blockchain: TRON (TRC-20 USDT) wallet network for fund distribution

Vulnerabilities Documented (6 total)

Repository Structure

operation-black-hole/
├── README.md                              # This file
├── METHODOLOGY.md                         # Investigation methodology & ethical boundaries
├── evidence/
│   ├── admin-panels/
│   │   └── fallaadmin.js                  # Extracted admin panel source (REDACTED)
│   └── forensic-images/
│       └── disk-hashes.sha256             # SHA-256 chain of custody manifest
├── analysis/
│   ├── app-attribution-matrix.md          # App-to-entity mapping with confidence levels
│   ├── infrastructure-map.md              # Network topology (Mermaid diagrams)
│   ├── financial-flow.md                  # Money laundering flow analysis
│   └── technical-report.md                # Full technical analysis
└── presentation/
    └── cst-interview-deck.md              # CST technical presentation

Verified Evidence Hashes

Key evidence files from the forensic workstation (SHA-256):

Note: The fallaadmin.js in this repository is a REDACTED version of the original. The original file (hash above) is preserved in the encrypted evidence archive. Hash difference is expected due to redaction of credentials and API keys.

Legal Framework

• Saudi Anti-Cybercrime Law (Royal Decree No. M/17)
• Anti-Money Laundering Law (Royal Decree No. M/31)
• Personal Data Protection Law (PDPL)
• SAMA Licensing Requirements (payment gateway compliance)

Methodology

See METHODOLOGY.md for full details on investigation methodology, tools, ethical boundaries, and chain of custody procedures.

Contact

Sulaiman Alshammari GraTech Forensic Division Case ID: OBH-2025-CST-001