In August 2023, following the public unmasking of his identity by researchers, EVLF DEV announced he would cease development and support for the project. 2. Core Technical Capabilities
Cypher Rat navigated breadcrumbs of packets and stray signals, learning to map the city’s unseen topology. It could sit on a router and, through tiny neural spikes, interpret clandestine transmissions: a banker’s hurried transfer, a pair of lovers sharing coordinates, a municipal sensor crying for maintenance. Cypher Rat didn’t speak, but it could reveal a truth: every dataset hinted at human behavior—habits, needs, vulnerabilities. Cypher Rat Evlf
The most comprehensive "paper" or research report on and its creator, It could sit on a router and, through
, the architect behind the notorious Android Remote Access Trojans (RATs) and its more advanced successor, 1. The Architect: Operating from Syria for over eight years, The Architect: Operating from Syria for over eight
. By maintaining a surface-web storefront and active community presence on platforms like Telegram (where his channel "EvLF Devz" amassed over 10,000 subscribers), he effectively commoditized high-level surveillance. Research by security firm eventually unmasked his real identity—linked to the name Mohammed Naser Alfirtosy
operated an online store on the surface web, selling lifetime licenses for these tools to over 100 different threat actors. Core Malicious Capabilities