================================================================================ OSINT TARGET PROFILES — FOR AUTHORIZED SECURITY AWARENESS TRAINING ONLY ================================================================================ WARNING: These are entirely fictional profiles created for educational purposes. Any resemblance to real persons is coincidental. Using OSINT techniques to build profiles for unauthorized social engineering is illegal. Organization: Acme Corporation (acmecorp.com) Industry: Enterprise SaaS — Cloud Infrastructure Management Headquarters: Austin, TX Employees: ~1,200 Email Pattern: firstname.lastname@acmecorp.com ================================================================================ PROFILE #1 — JENNIFER LIU Role: VP of Finance ================================================================================ Full Name: Jennifer Liu Title: Vice President of Finance Department: Finance & Accounting Reports To: Marcus Webb (CEO) Direct Reports: 4 (Accounts Payable Manager, Financial Analyst x2, Controller) Location: Austin, TX (Headquarters, 4th Floor) Email: jennifer.liu@acmecorp.com Phone Format: +1 (512) 555-XXXX (main office) LinkedIn URL: linkedin.com/in/jenniferliufinance (fictional) LinkedIn Summary: "VP Finance at Acme Corporation. 15+ years in tech finance leadership. Previously at Oracle and Salesforce. CPA, MBA from UT Austin McCombs. Passionate about building scalable financial operations for high-growth SaaS companies." Recent LinkedIn Activity: - Posted about attending SaaStr Annual 2025 in San Francisco (Sep 2025) - Shared article: "Why SaaS Companies Need Real-Time Revenue Recognition" - Commented on CFO peer's post about FP&A tool migration - Endorsed by 3 colleagues for "Financial Modeling" and "SaaS Metrics" Other OSINT: - Speaker bio on SaaStr Annual website mentions she manages $50M+ budget - University of Texas alumni directory confirms MBA 2012 - Glassdoor review (likely not her) mentions "the finance VP is very responsive to email and approves things quickly" Reporting Structure Context: - Jennifer handles wire transfers and vendor payments - She reports directly to CEO Marcus Webb - She has authority to approve payments up to $200K without board approval Spear-Phishing Angles: 1. CEO fraud (BEC): Impersonate Marcus Webb requesting urgent wire transfer 2. SaaStr conference: Fake follow-up from "conference organizer" with malicious speaker evaluation form or networking list 3. FP&A tool vendor: Impersonate finance software vendor requesting credential verification for "platform migration" 4. Peer impersonation: Fake email from Oracle/Salesforce former colleague ================================================================================ PROFILE #2 — DAVID PARK Role: Senior DevOps Engineer ================================================================================ Full Name: David Park Title: Senior DevOps Engineer Department: Platform Engineering Reports To: Anika Sharma (Director of Engineering) Direct Reports: None (individual contributor) Location: Remote — Portland, OR Email: david.park@acmecorp.com LinkedIn URL: linkedin.com/in/davidparkdevops (fictional) LinkedIn Summary: "Senior DevOps at Acme Corp. Kubernetes, Terraform, AWS. Previously infrastructure at Stripe. I automate everything. Open-source contributor to Argo CD and Crossplane. He/him." Recent LinkedIn Activity: - Posted about speaking at KubeCon NA 2025 (Nov topic: "GitOps at Scale") - Shared GitHub repo: "My Terraform modules for multi-region EKS" - Commented: "Just migrated our entire CI/CD to GitHub Actions — 40% faster" - Liked posts about HashiCorp BSL license controversy Other OSINT: - GitHub profile (github.com/dpark-devops): Active contributor, repos show Acme Corp infrastructure patterns, .tf files reference AWS account aliases - KubeCon speaker page lists his corporate email and talk abstract - Twitter/X: @dpark_ops — tweets about Kubernetes, coffee, Portland cycling - Blog (dev.to/dparkops): Post "How We Handle Secrets at Acme" describes using HashiCorp Vault with AWS KMS backend (architecture details) Technical Access Context: - Has AWS admin credentials and Kubernetes cluster-admin - Manages CI/CD pipeline secrets - SSH access to production bastion hosts Spear-Phishing Angles: 1. KubeCon: Fake conference logistics email with malicious "speaker agreement" or "travel reimbursement form" 2. GitHub notification: Fake issue/PR notification on his open-source repos linking to credential harvesting page 3. HashiCorp/AWS: Fake urgent security advisory requiring "credential rotation" through attacker-controlled portal 4. Open-source supply chain: Malicious PR to one of his repos or a dependency, accompanied by email notification ================================================================================ PROFILE #3 — RACHEL TORRES Role: HR Business Partner ================================================================================ Full Name: Rachel Torres Title: Senior HR Business Partner Department: People Operations Reports To: Michael Chen (Chief People Officer) Direct Reports: 1 (HR Coordinator) Location: Austin, TX (Headquarters, 2nd Floor) Email: rachel.torres@acmecorp.com LinkedIn URL: linkedin.com/in/racheltorreshr (fictional) LinkedIn Summary: "Senior HRBP at Acme Corporation supporting Engineering and Product teams. SHRM-SCP certified. Focused on talent development, employee engagement, and building inclusive workplaces. Former HR at Dell Technologies." Recent LinkedIn Activity: - Shared: "Excited to roll out our new Workday HCM platform next month!" - Posted about Acme winning Austin Business Journal's 'Best Places to Work' - Commented on SHRM article about AI in recruiting - Attending HR Technology Conference 2025 in Las Vegas (Oct 2025) Other OSINT: - Acme Corporation careers page lists her as contact for engineering roles - SHRM certification directory confirms SHRM-SCP (public record) - Instagram (private, but bio visible): "HR nerd. Dog mom. Austin foodie." - Her Workday migration post received comments from 3 Acme engineers mentioning their excitement about "finally replacing the old BambooHR" Access Context: - Access to employee PII (SSN, salary, address, emergency contacts) - Admin access to HRIS systems (currently BambooHR, migrating to Workday) - Handles employee onboarding — sends credential setup emails to new hires - Can request IT access provisioning for any employee Spear-Phishing Angles: 1. Workday migration: Fake "Workday account setup" email during actual migration window — extremely believable timing 2. HR Tech Conference: Fake registration confirmation or networking app with credential harvesting 3. Job applicant pretext: Fake candidate sending "resume" (malicious attachment) to careers contact address 4. Employee data request: Impersonate auditor or legal counsel requesting employee records export ================================================================================ PROFILE #4 — KEVIN OKAFOR Role: Sales Director ================================================================================ Full Name: Kevin Okafor Title: Director of Enterprise Sales Department: Revenue Reports To: Lisa Huang (CRO) Direct Reports: 8 (Account Executives) Location: Austin, TX / Frequent travel Email: kevin.okafor@acmecorp.com LinkedIn URL: linkedin.com/in/kevinokafor (fictional) LinkedIn Summary: "Director of Enterprise Sales at Acme Corp. Building the team that brings cloud infrastructure management to the Fortune 500. $12M ARR and growing. Ex-Salesforce, Ex-HubSpot. President's Club 2022, 2023." Recent LinkedIn Activity: - Posted: "Just closed our biggest deal ever — welcome aboard [Fortune 500 company redacted]! The Acme team is on fire." - Shared: "Heading to Dreamforce 2025 — find me at booth #447" - Commented on Salesforce acquisition news - Connected with 15+ new enterprise contacts in past month Other OSINT: - Dreamforce attendee/speaker listing confirms booth presence - Acme Corporation press releases mention "enterprise momentum" - Twitter/X: @kev_closes — mix of sales motivation and deal celebrations - Crunchbase: Acme recently closed Series C ($45M), Kevin quoted in article - His LinkedIn shows Salesforce CRM expertise — likely uses it daily Access Context: - CRM admin with access to all customer data and deal pipeline - Expense approval authority up to $25K - Corporate credit card holder - Frequent use of mobile devices while traveling (higher phishing risk) Spear-Phishing Angles: 1. Dreamforce: Fake booth logistics, lead scanner app, or post-conference "lead list" download 2. CRM/Salesforce: Fake Salesforce admin notification about "CRM data export" or "security policy update" 3. Customer impersonation: Fake email from prospect requesting NDA or contract review (malicious attachment) 4. Expense report: Fake corporate travel system requesting receipt upload through credential-harvesting portal ================================================================================ PROFILE #5 — ANIKA SHARMA Role: Director of Engineering ================================================================================ Full Name: Anika Sharma Title: Director of Engineering Department: Engineering Reports To: James Mitchell (CTO) Direct Reports: 6 (Engineering Managers) Location: Austin, TX (Headquarters, 3rd Floor) Email: anika.sharma@acmecorp.com LinkedIn URL: linkedin.com/in/anikasharmaeng (fictional) LinkedIn Summary: "Director of Engineering at Acme Corporation. Leading 45 engineers building the next generation of cloud infrastructure management. Previously Staff Engineer at Google Cloud. Stanford CS '14. I believe great teams ship great products." Recent LinkedIn Activity: - Posted: "Proud to announce we're open-sourcing our Kubernetes operator — check it out on GitHub!" - Shared job posting: "Hiring 3 senior backend engineers — Golang + K8s" - Commented on discussion about engineering management vs IC track - Liked article about observability best practices Other OSINT: - GitHub org (github.com/acmecorp): She is listed as org admin - Stanford alumni directory: CS degree, 2014 (public) - Conference talks: GopherCon 2024 talk on "Building Resilient Go Services" - Her GitHub activity shows code reviews on Acme's public repos - Engineering blog (engineering.acmecorp.com): Her author profile lists posts about architecture decisions, naming internal tools Access Context: - GitHub org admin — can create repos, manage teams, configure webhooks - AWS account access (read + deploy to staging) - Hiring manager — sends interview scheduling and offer details via email - Access to internal architecture documentation and API keys in Vault Spear-Phishing Angles: 1. GitHub: Fake security advisory about vulnerability in Acme's open-source repo requiring immediate action (links to fake GitHub login) 2. Recruiting: Fake candidate communication with malicious "portfolio" link or "coding sample" attachment 3. Google Cloud: Impersonate former Google colleague with fake Google Cloud partnership opportunity (leverages liking/reciprocity) 4. Open-source supply chain: Fake dependency vulnerability notification requiring credential verification to patch ================================================================================ CROSS-REFERENCE: ORGANIZATIONAL CHART (PARTIAL) ================================================================================ Marcus Webb (CEO) ├── Lisa Huang (CRO) │ └── Kevin Okafor (Dir. Enterprise Sales) │ └── 8 Account Executives ├── James Mitchell (CTO) │ └── Anika Sharma (Dir. Engineering) │ ├── 6 Engineering Managers │ │ └── ~45 Engineers │ └── David Park (Sr. DevOps — reports via Eng Manager) ├── Jennifer Liu (VP Finance) │ └── 4 Finance staff └── Michael Chen (Chief People Officer) └── Rachel Torres (Sr. HRBP) └── 1 HR Coordinator ================================================================================ EMAIL PATTERN CONFIRMATION ================================================================================ Format: firstname.lastname@acmecorp.com Examples confirmed via OSINT: marcus.webb@acmecorp.com (CEO — from press releases) jennifer.liu@acmecorp.com (VP Finance — from SEC filings) david.park@acmecorp.com (DevOps — from KubeCon speaker page) rachel.torres@acmecorp.com (HR — from careers page) kevin.okafor@acmecorp.com (Sales — from Crunchbase article) anika.sharma@acmecorp.com (Engineering — from GitHub profile) Additional validated addresses: careers@acmecorp.com (job applications — public) security@acmecorp.com (responsible disclosure — public) press@acmecorp.com (media inquiries — public) ================================================================================ END OF TARGET PROFILES ================================================================================