The threat actor claims to have gained unauthorized access to a small network of the Bulgarian Armed Forces (ARMF.BG) and obtained information from local storage systems, databases, files, and other internal resources. The post includes alleged reconnaissance, foothold, Linux pivot, database cross-reference, and SSRF-related evidence screenshots, along with links to purported backups of the collected data.