================================================================================
OSINT TARGET PROFILES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY
================================================================================

WARNING: These are entirely fictional profiles created for educational
purposes. Any resemblance to real persons is coincidental. Using OSINT
techniques to build profiles for unauthorized social engineering is illegal.

Organization: Acme Corporation (acmecorp.com)
Industry: Enterprise SaaS — Cloud Infrastructure Management
Headquarters: Austin, TX
Employees: ~1,200
Email Pattern: firstname.lastname@acmecorp.com

================================================================================
PROFILE #1 — JENNIFER LIU
Role: VP of Finance
================================================================================

Full Name:       Jennifer Liu
Title:           Vice President of Finance
Department:      Finance & Accounting
Reports To:      Marcus Webb (CEO)
Direct Reports:  4 (Accounts Payable Manager, Financial Analyst x2, Controller)
Location:        Austin, TX (Headquarters, 4th Floor)
Email:           jennifer.liu@acmecorp.com
Phone Format:    +1 (512) 555-XXXX (main office)
LinkedIn URL:    linkedin.com/in/jenniferliufinance (fictional)

LinkedIn Summary:
  "VP Finance at Acme Corporation. 15+ years in tech finance leadership.
   Previously at Oracle and Salesforce. CPA, MBA from UT Austin McCombs.
   Passionate about building scalable financial operations for high-growth
   SaaS companies."

Recent LinkedIn Activity:
  - Posted about attending SaaStr Annual 2025 in San Francisco (Sep 2025)
  - Shared article: "Why SaaS Companies Need Real-Time Revenue Recognition"
  - Commented on CFO peer's post about FP&A tool migration
  - Endorsed by 3 colleagues for "Financial Modeling" and "SaaS Metrics"

Other OSINT:
  - Speaker bio on SaaStr Annual website mentions she manages $50M+ budget
  - University of Texas alumni directory confirms MBA 2012
  - Glassdoor review (likely not her) mentions "the finance VP is very
    responsive to email and approves things quickly"

Reporting Structure Context:
  - Jennifer handles wire transfers and vendor payments
  - She reports directly to CEO Marcus Webb
  - She has authority to approve payments up to $200K without board approval

Spear-Phishing Angles:
  1. CEO fraud (BEC): Impersonate Marcus Webb requesting urgent wire transfer
  2. SaaStr conference: Fake follow-up from "conference organizer" with
     malicious speaker evaluation form or networking list
  3. FP&A tool vendor: Impersonate finance software vendor requesting
     credential verification for "platform migration"
  4. Peer impersonation: Fake email from Oracle/Salesforce former colleague

================================================================================
PROFILE #2 — DAVID PARK
Role: Senior DevOps Engineer
================================================================================

Full Name:       David Park
Title:           Senior DevOps Engineer
Department:      Platform Engineering
Reports To:      Anika Sharma (Director of Engineering)
Direct Reports:  None (individual contributor)
Location:        Remote — Portland, OR
Email:           david.park@acmecorp.com
LinkedIn URL:    linkedin.com/in/davidparkdevops (fictional)

LinkedIn Summary:
  "Senior DevOps at Acme Corp. Kubernetes, Terraform, AWS. Previously
   infrastructure at Stripe. I automate everything. Open-source contributor
   to Argo CD and Crossplane. He/him."

Recent LinkedIn Activity:
  - Posted about speaking at KubeCon NA 2025 (Nov topic: "GitOps at Scale")
  - Shared GitHub repo: "My Terraform modules for multi-region EKS"
  - Commented: "Just migrated our entire CI/CD to GitHub Actions — 40% faster"
  - Liked posts about HashiCorp BSL license controversy

Other OSINT:
  - GitHub profile (github.com/dpark-devops): Active contributor, repos show
    Acme Corp infrastructure patterns, .tf files reference AWS account aliases
  - KubeCon speaker page lists his corporate email and talk abstract
  - Twitter/X: @dpark_ops — tweets about Kubernetes, coffee, Portland cycling
  - Blog (dev.to/dparkops): Post "How We Handle Secrets at Acme" describes
    using HashiCorp Vault with AWS KMS backend (architecture details)

Technical Access Context:
  - Has AWS admin credentials and Kubernetes cluster-admin
  - Manages CI/CD pipeline secrets
  - SSH access to production bastion hosts

Spear-Phishing Angles:
  1. KubeCon: Fake conference logistics email with malicious "speaker
     agreement" or "travel reimbursement form"
  2. GitHub notification: Fake issue/PR notification on his open-source repos
     linking to credential harvesting page
  3. HashiCorp/AWS: Fake urgent security advisory requiring "credential
     rotation" through attacker-controlled portal
  4. Open-source supply chain: Malicious PR to one of his repos or a
     dependency, accompanied by email notification

================================================================================
PROFILE #3 — RACHEL TORRES
Role: HR Business Partner
================================================================================

Full Name:       Rachel Torres
Title:           Senior HR Business Partner
Department:      People Operations
Reports To:      Michael Chen (Chief People Officer)
Direct Reports:  1 (HR Coordinator)
Location:        Austin, TX (Headquarters, 2nd Floor)
Email:           rachel.torres@acmecorp.com
LinkedIn URL:    linkedin.com/in/racheltorreshr (fictional)

LinkedIn Summary:
  "Senior HRBP at Acme Corporation supporting Engineering and Product teams.
   SHRM-SCP certified. Focused on talent development, employee engagement,
   and building inclusive workplaces. Former HR at Dell Technologies."

Recent LinkedIn Activity:
  - Shared: "Excited to roll out our new Workday HCM platform next month!"
  - Posted about Acme winning Austin Business Journal's 'Best Places to Work'
  - Commented on SHRM article about AI in recruiting
  - Attending HR Technology Conference 2025 in Las Vegas (Oct 2025)

Other OSINT:
  - Acme Corporation careers page lists her as contact for engineering roles
  - SHRM certification directory confirms SHRM-SCP (public record)
  - Instagram (private, but bio visible): "HR nerd. Dog mom. Austin foodie."
  - Her Workday migration post received comments from 3 Acme engineers
    mentioning their excitement about "finally replacing the old BambooHR"

Access Context:
  - Access to employee PII (SSN, salary, address, emergency contacts)
  - Admin access to HRIS systems (currently BambooHR, migrating to Workday)
  - Handles employee onboarding — sends credential setup emails to new hires
  - Can request IT access provisioning for any employee

Spear-Phishing Angles:
  1. Workday migration: Fake "Workday account setup" email during actual
     migration window — extremely believable timing
  2. HR Tech Conference: Fake registration confirmation or networking app
     with credential harvesting
  3. Job applicant pretext: Fake candidate sending "resume" (malicious
     attachment) to careers contact address
  4. Employee data request: Impersonate auditor or legal counsel requesting
     employee records export

================================================================================
PROFILE #4 — KEVIN OKAFOR
Role: Sales Director
================================================================================

Full Name:       Kevin Okafor
Title:           Director of Enterprise Sales
Department:      Revenue
Reports To:      Lisa Huang (CRO)
Direct Reports:  8 (Account Executives)
Location:        Austin, TX / Frequent travel
Email:           kevin.okafor@acmecorp.com
LinkedIn URL:    linkedin.com/in/kevinokafor (fictional)

LinkedIn Summary:
  "Director of Enterprise Sales at Acme Corp. Building the team that brings
   cloud infrastructure management to the Fortune 500. $12M ARR and growing.
   Ex-Salesforce, Ex-HubSpot. President's Club 2022, 2023."

Recent LinkedIn Activity:
  - Posted: "Just closed our biggest deal ever — welcome aboard [Fortune 500
    company redacted]! The Acme team is on fire."
  - Shared: "Heading to Dreamforce 2025 — find me at booth #447"
  - Commented on Salesforce acquisition news
  - Connected with 15+ new enterprise contacts in past month

Other OSINT:
  - Dreamforce attendee/speaker listing confirms booth presence
  - Acme Corporation press releases mention "enterprise momentum"
  - Twitter/X: @kev_closes — mix of sales motivation and deal celebrations
  - Crunchbase: Acme recently closed Series C ($45M), Kevin quoted in article
  - His LinkedIn shows Salesforce CRM expertise — likely uses it daily

Access Context:
  - CRM admin with access to all customer data and deal pipeline
  - Expense approval authority up to $25K
  - Corporate credit card holder
  - Frequent use of mobile devices while traveling (higher phishing risk)

Spear-Phishing Angles:
  1. Dreamforce: Fake booth logistics, lead scanner app, or post-conference
     "lead list" download
  2. CRM/Salesforce: Fake Salesforce admin notification about "CRM data
     export" or "security policy update"
  3. Customer impersonation: Fake email from prospect requesting NDA or
     contract review (malicious attachment)
  4. Expense report: Fake corporate travel system requesting receipt upload
     through credential-harvesting portal

================================================================================
PROFILE #5 — ANIKA SHARMA
Role: Director of Engineering
================================================================================

Full Name:       Anika Sharma
Title:           Director of Engineering
Department:      Engineering
Reports To:      James Mitchell (CTO)
Direct Reports:  6 (Engineering Managers)
Location:        Austin, TX (Headquarters, 3rd Floor)
Email:           anika.sharma@acmecorp.com
LinkedIn URL:    linkedin.com/in/anikasharmaeng (fictional)

LinkedIn Summary:
  "Director of Engineering at Acme Corporation. Leading 45 engineers building
   the next generation of cloud infrastructure management. Previously Staff
   Engineer at Google Cloud. Stanford CS '14. I believe great teams ship
   great products."

Recent LinkedIn Activity:
  - Posted: "Proud to announce we're open-sourcing our Kubernetes operator —
    check it out on GitHub!"
  - Shared job posting: "Hiring 3 senior backend engineers — Golang + K8s"
  - Commented on discussion about engineering management vs IC track
  - Liked article about observability best practices

Other OSINT:
  - GitHub org (github.com/acmecorp): She is listed as org admin
  - Stanford alumni directory: CS degree, 2014 (public)
  - Conference talks: GopherCon 2024 talk on "Building Resilient Go Services"
  - Her GitHub activity shows code reviews on Acme's public repos
  - Engineering blog (engineering.acmecorp.com): Her author profile lists
    posts about architecture decisions, naming internal tools

Access Context:
  - GitHub org admin — can create repos, manage teams, configure webhooks
  - AWS account access (read + deploy to staging)
  - Hiring manager — sends interview scheduling and offer details via email
  - Access to internal architecture documentation and API keys in Vault

Spear-Phishing Angles:
  1. GitHub: Fake security advisory about vulnerability in Acme's open-source
     repo requiring immediate action (links to fake GitHub login)
  2. Recruiting: Fake candidate communication with malicious "portfolio" link
     or "coding sample" attachment
  3. Google Cloud: Impersonate former Google colleague with fake Google Cloud
     partnership opportunity (leverages liking/reciprocity)
  4. Open-source supply chain: Fake dependency vulnerability notification
     requiring credential verification to patch

================================================================================
CROSS-REFERENCE: ORGANIZATIONAL CHART (PARTIAL)
================================================================================

    Marcus Webb (CEO)
    ├── Lisa Huang (CRO)
    │   └── Kevin Okafor (Dir. Enterprise Sales)
    │       └── 8 Account Executives
    ├── James Mitchell (CTO)
    │   └── Anika Sharma (Dir. Engineering)
    │       ├── 6 Engineering Managers
    │       │   └── ~45 Engineers
    │       └── David Park (Sr. DevOps — reports via Eng Manager)
    ├── Jennifer Liu (VP Finance)
    │   └── 4 Finance staff
    └── Michael Chen (Chief People Officer)
        └── Rachel Torres (Sr. HRBP)
            └── 1 HR Coordinator

================================================================================
EMAIL PATTERN CONFIRMATION
================================================================================

Format: firstname.lastname@acmecorp.com
Examples confirmed via OSINT:
  marcus.webb@acmecorp.com       (CEO — from press releases)
  jennifer.liu@acmecorp.com      (VP Finance — from SEC filings)
  david.park@acmecorp.com        (DevOps — from KubeCon speaker page)
  rachel.torres@acmecorp.com     (HR — from careers page)
  kevin.okafor@acmecorp.com      (Sales — from Crunchbase article)
  anika.sharma@acmecorp.com      (Engineering — from GitHub profile)

Additional validated addresses:
  careers@acmecorp.com           (job applications — public)
  security@acmecorp.com          (responsible disclosure — public)
  press@acmecorp.com             (media inquiries — public)

================================================================================
END OF TARGET PROFILES
================================================================================
