The findings reveal something that no previous investigation has documented: direct infrastructure overlap between Q-adjacent platforms and HBGary Federal — the cybersecurity firm exposed in 2011 for building sockpuppet automation tools ("Persona Management" software) under contract with the U.S. Air Force and Department of Defense.
What Is HBGary Federal?
In February 2011, the hacktivist collective Anonymous breached HBGary Federal's servers and published over 70,000 internal emails. What they found became one of the most significant leaks in information warfare history.
After the hack, CEO Aaron Barr resigned, HBGary Federal shut down, the parent company was sold to defense contractor ManTech International in 2012, and personnel were dispersed across the defense/intelligence contracting ecosystem.
The emails became public record. They were indexed by WikiLeaks, analyzed by journalists at Ars Technica, The Guardian, and others, and are now searchable through investigative databases like OCCRP's Aleph platform.
That was 2011. The question nobody had asked until now: where did this infrastructure show up next?
Seven Networks, Two Clusters
Each Maltego export represents a network radiating outward from a central domain — its DNS records, hosting infrastructure, linked sites, email addresses, WHOIS data, and organizational connections. Together, they map the hidden architecture behind Q-adjacent content distribution.
The pattern is stark. Four of seven networks share the same three infrastructure markers: HBGary, OCCRP, and WikiLeaks. The other three contain none. Two distinct clusters emerge.
wrongthink.net → HBGary Federal
The wrongthink.net network analysis produced the most significant single finding in the dataset: 68 references to hbgary.com and 12 distinct HBGary email addresses embedded in a network that simultaneously connects to Q-focused websites and a notorious harassment platform.
The same network map that shows Q-focused infrastructure (trusttheq.com) integrated with a notorious harassment and doxing forum (kiwifarms.net) also contains the email addresses of personnel from the firm that built sockpuppet tools for the U.S. military.
jedi-sec.com → FSB · Anonymous · InfoWars
The jedisec network is unique in the dataset. It's the only analysis containing references to Russian state intelligence — and it maps a pathway that connects hacktivist infrastructure, Russian government systems, and American right-wing media.
- fsb.ru — 1,403 mentions
- aaron@hbgary.com — 15 mentions
- anonops.com — 640
- lulzsec.org — 478
- millennialmillie.com — 454
- voiceofrussia.ru — 411
- su0
- myn0
- na.com — 386
- jar2.com — 1,143
- aleph.occrp.org — 1,693
The network radiates from jedi-sec.com outward through several distinct layers:
The Hacktivist Layer: AnonOps (the central IRC coordination hub for Anonymous operations), LulzSec (the hacker group responsible for attacks on Sony, CIA, and FBI websites), and su0myn0na.com ("anonymous" spelled backwards). These represent the operational infrastructure of the hacktivist movement that targeted HBGary in 2011.
The Russian Intelligence Layer: 1,403 references to FSB.ru subdomains — including the FSB's public-facing site, its academy, and multiple internal systems (mpi.fsb.ru, kpi.fsb.ru, clsz.fsb.ru). Voice of Russia (Russian state international media, predecessor to RT/Sputnik) appears alongside JAR2 — a site operated by John Anthony Robles, an American-born Russian citizen who worked as a Voice of Russia journalist.
The InfoWars Layer: millennialmillie.com (454 mentions) — Millie Weaver, an InfoWars correspondent who produced the "ShadowGate" documentary about alleged government contractor surveillance operations.
The HBGary Connection: aaron@hbgary.com — Aaron Barr himself, the CEO whose plan to identify and dox Anonymous members triggered the 2011 hack. His email address appearing in the jedisec network creates a closed loop: Anonymous hacked HBGary → HBGary infrastructure appears in Anonymous-adjacent network analysis → the same network connects to Russian intelligence.
Marx Hubbard → Gafni → HBGary
The gafni2 network is perhaps the most unexpected. It maps the infrastructure around two figures in the consciousness/spiritual leadership space — and finds the same HBGary thread running through it.
- barbaramarxhubbard.com — 854
- centerforintegralwisdom.org — 963
- onemountainmanypaths.org — 717
- whoismarcgafni.com — 193
- ievolve.org — 229
- hbgary.com — 30
- phil@hbgary.com — 12 mentions
Barbara Marx Hubbard (1929–2019) was a futurist, author, and "conscious evolution" advocate connected to the Thrive Movement (Foster Gamble, Procter & Gamble heir) and the Ellsberg family (Daniel Ellsberg, Pentagon Papers). Her work provided the ideological bridge between progressive-left activism, spiritual/consciousness communities, and the networks that later fed into QAnon recruitment pipelines.
Marc Gafni is a controversial spiritual teacher who founded the Center for Integral Wisdom (CIW) despite credible accusations of sexual abuse from multiple women. CIW (963 mentions in this analysis) was his vehicle for continued influence within the consciousness/integral philosophy community.
The gafni2 network also produced the highest OCCRP reference count of any analysis (2,132 mentions) and contains 8 HBGary email addresses — establishing that the spiritual/consciousness infrastructure layer shares structural connections with the same sockpuppet contractor ecosystem found in the Q-adjacent and WikiLeaks-support networks.
The Public-Facing Layer
QSuperHeroes.com (qheroes.pdf · 347 pages)
WordPress-based Q promotion site linked to qanon.pub (the primary Q drop aggregator, 270 mentions) and an extensive Keybase encrypted messaging infrastructure (qntmpkts.keybase.pub — 219 mentions with multiple subdomains). The Keybase layer suggests private, encrypted coordination channels running parallel to public content distribution — operational security consistent with coordinated operations rather than organic grassroots activity.
George News (george_news.pdf · 713 pages)
One of the most prominent "insider" Q accounts. Network analysis reveals connections to qanon-france.com (225 mentions — international expansion) and an anomalous connection to greenparty.org (218 mentions — U.S. Green Party infrastructure). The French Q network connection shows coordinated international expansion. The Green Party connection requires further investigation.
DivineCosmos.com (divinecosmos.pdf · 511 pages)
David Wilcock's consciousness/disclosure platform. Functions as a spiritual legitimacy cover layer — making Q-adjacent ideas digestible to new-age audiences through "ascension," ancient civilizations, and suppressed-technology narratives. Same ideological function as Lisa Clapier's UN ECOSOC credentials or Cobra's "Victory of the Light" messaging: peace-and-consciousness aesthetics masking recruitment infrastructure.
What Does This Mean?
The presence of HBGary infrastructure across four distinct network analyses admits three possible interpretations. Intellectual honesty requires presenting all three.
Next Article:
If you want the original Maltego files, you can contact me via email or DM.