TeamHDP Exposed
The Complete Network Behind Venezuelan Cybercriminal Gerardo Gil Dams
OSINT Investigation by Ringmast4r — February 2026
⚠ ACTIVE THREAT — Subject is threatening the investigator and their family. FBI, DHS, and local police have been contacted.
20+
Individuals Identified
The Founder CRITICAL
Founder & CEO of TeamHDP • Cybercriminal using hacktivism as cover
DOB: September 29, 1983
Origin: Estado Falcon, Venezuela
Location: Doral, FL 33166
Education: Universidad Santiago Marino
Former Employer: PDVSA (Marine)
Instagram: @ggild1983 (14.6K), @gerardojg18
Twitter/X: @ThePinguinHDP, @VECERTAmerica, @VECERTRadar
LinkedIn: Gerardo Jose Gil Dams (PDVSA)
Chess.com: gil-dams
GETTR: Gerardo J Gil Dams
XSS.is: Account on Russian cybercrime forum
Businesses:
• VECERT Security Labs USA LLC (Suite 2B, Doral) — FL Doc# L25000472380
• TurboCredit.us (Suite 2C, Doral) — credit repair
• Gil Nursery and Produce Inc — DISSOLVED 2022
• PPP Loan: $20,832 for fake construction co
Addresses:
• 4711 NW 79th Ave, Suite 2B, Doral, FL 33166
• 4711 NW 79th Ave, Suite 2C, Doral, FL 33166
• 7451 Riviera Blvd #209, Miramar, FL 33023
• 8255 Lake Dr, Las Vistas F302, Doral, FL 33166
• 1621 Bay Rd #601, Miami Beach, FL 33139
VENEZUELAN ARREST WARRANT — July 6, 2021
Charges: Promotion of hatred, unauthorized access/sabotage of protected systems
Also investigated for: drug trafficking, extortion, sexual crimes
FLED TO UNITED STATES before warrant executed
Admission via Instagram DM:
"You got me, Cameron. I'm sorry you support a terrorist regime while living in the United States. Google my name along with the words 'teamhdp' and then you'll cry."
Analyst Assessment
Gerardo Gil Dams is a cybercriminal who discovered that anti-Maduro hacktivism is the perfect cover story. The political operations (airport hack, SEBIN leaks, Hezbollah exposure) are real but serve as a shield — they generate international press, build legitimacy, and create a "freedom fighter" narrative that deflects from ransomware, extortion, and data sales underneath. When confronted, his instinct was not to deny but to flex — "Google my name." That's not a political dissident. That's someone who thinks their reputation makes them untouchable.
Core Members 7 IDENTIFIED
Co-Operator — Extortion Operations
Nationality: Venezuelan
Social Media: Facebook, Instagram, YouTube (confirmed "El Rey Tukky")
Father: Manuel Galindo Ballesteros — former Comptroller General of Venezuela (2014-2018). Had 13 relatives in his organization (nepotism scandal)
• Assembles hackers to obtain private info on politicians and public figures in Miami for blackmail
• Coerces hacked individuals into becoming informants — those who refuse get publicly doxed
• Labeled "estafador" (scammer) and "sadico" by Venezuelan media
• Called "supreme fornicator of Petare"
• Newman Perez got 6 TeamHDP accounts banned
• Venezuelan media published videos exposing him as "one of the brains" behind TeamHDP
Top Hacker — Technical Lead for Major Operations
Real Name: UNKNOWN — #1 PRIORITY TARGET TO IDENTIFY
Nationality: Venezuelan
Twitter: @Comandpsa
• Most prolific hacker in TeamHDP
• Led November 2023 PSOE (Spain Socialist Party) breach
• Accessed email servers, threatened PM Pedro Sanchez
• Collaborates with hackers from other countries
• El Espanol (Spain) published investigation naming FailSistem
• International collaboration suggests identity may be traceable through non-Venezuelan channels
Propaganda & Bot Network Operator
Nationality: Venezuelan
Twitter/X: @zuricht94
• Public-facing spokesperson for TeamHDP
• Publishes group achievements and press releases
• Anti-Maduro commentary, Venezuela-Colombia border reports
• Manages coordinated inauthentic behavior via bot network
• Amplifier accounts: DolarToday (2.9M), HDPY0 (142K), YoSoyJustin (130K)
Doxing Campaigns & Extortion Portal Operator
DOB: ~2001 (24-25 years old)
Location: SPAIN
Nationality: Venezuelan
• Directed nuevaprensaamerica.com for TeamHDP doxing campaigns
• Articles deleted by Laura de Rosa, Galindo, Gil Dams after campaigns
• Currently runs fraudulent "motivational coaching" as cover
• Plagiarizes The Freedom Post identity from Spain
• Former students call it "estafa emocional y economica"
PART OF FAMILY EXTORTION ENTERPRISE — See Castro Family section below
Airport Hack Insider
Location: Margarita Island, Nueva Esparta, Venezuela
Employer: Bolivariana de Puertos (Bolipuertos)
• Provided insider access for July 2021 airport screen hack
• Detained by SEBIN July 2021 with co-detainees Cesar Boada & Auremys Graterol
• Court ordered release Dec 2, 2021 — authorities re-detained all three at San Antonio Prison for 8+ days
• Released Dec 11, 2021 under 3.5-year judicial supervision
• Gil Dams publicly denied connection — Avino may be a scapegoat
Dissemination & Evidence Cleanup
Nationality: Venezuelan
• Helps disseminate TeamHDP leaks and doxing campaigns
• Deletes articles from nuevaprensaamerica.com after campaigns conclude
• Manages information warfare cycle: publish dox → extort → delete evidence
• Works alongside Miguel Galindo and Gil Dams
• NEEDS FULL IDENTIFICATION
The Extortion Machine $70K+ PER TARGET
TeamHDP operates a systematic extortion pipeline. This isn't random hacking — it's an organized shakedown operation with specialized roles.
1
HACK
FailSistem or affiliates breach target's data, emails, photos
→
2
COMPILE
Galindo assembles compromising info on politicians, public figures
→
3
PUBLISH
Aaron Castro publishes across 15+ portals (NuevaPrensaAmerica, Noticias Candela)
→
4
DEMAND
$70,000+ to remove publications. Cooperate or get doxed worse.
→
5
CLEANUP
Laura de Rosa deletes articles after payment. Evidence destroyed.
The Informant Coercion Cycle
Hacked individuals are given a choice: become an informant for TeamHDP or get publicly doxed. Those who cooperate feed the group more intelligence on other targets. Those who refuse have their personal data, communications, and photos published across the portal network. Multiple independent sources (Newman Perez, @estafascrypto, Venezuelan media) have documented this pattern.
The Castro Crime Family INTERPOL RED NOTICE
Aaron Castro Pulgar isn't just a TeamHDP member — he's part of a family extortion enterprise that operates independently and through TeamHDP.
Patriarch — Professional Extortionist & Former Intelligence Agent
Age: 55 — Caracas native
Former Agency: DISIP (Venezuelan intelligence, now dissolved)
Criminal Record: Since 1991 — firearms, robbery, drug trafficking
Operations: 15+ digital portals for extortion (primary: "Noticias Candela")
SENTENCED TO 40 MONTHS IN PRISON IN PANAMA
Crime: Extorting the son-in-law of Panamanian President Laurentino Cortizo
INTERPOL RED NOTICE REQUESTED
CAPTURED IN SPAIN
Called "the biggest extortionist in Venezuela and Panama" by Notitarde. Described as "professional in defamation and extortion" who pivoted from street crime to digital blackmail.
Co-Conspirator in Family Extortion Operations
Role: Co-conspirator in all family extortion operations
Location: Unknown
• Active participant in the Noticias Candela network
Family MO: The $70,000 Shakedown
1. Obtain compromising or personal information about target (via hacking, HUMINT, or purchase from TeamHDP)
2. Publish defamatory content across 15+ digital portals simultaneously
3. Demand $70,000+ to remove all publications
4. If target pays, articles are deleted by Laura de Rosa
5. If target refuses, escalate with more publications and doxing
Sources: elfarodelmorro.net, albertonews.com, globovision.com, notitarde.com.ve
The BreachForums Pipeline VECERT = THE BREACH?
Gil Dams operates VECERT as a "threat intelligence" company via @VECERTRadar on Twitter. But VECERTRadar has published breach details BEFORE they appeared on criminal forums — proving Gil Dams either IS the breach actor or has direct advance access.
🕶 HACK
malconguerra2 / Gordon Freeman / HvckMvSoneria33 breach LATAM targets
→
📰 PUBLISH
VECERTRadar tweets breach alert BEFORE it appears on BreachForums
→
💰 PROFIT
VECERT looks like threat intel. Gil Dams sells API access. Data sold separately.
→
🎭 REPEAT
Same pattern across Cashea, Bancrecer, Peru courts, UNMSM, Spain ministry
BreachForums Actor — LATAM Focus
Platform: BreachForums
Known Breaches:
• Cashea (Venezuelan fintech) — 79,006,942 records (46.5 GB)
• Peru courts (Corte Superior de Lima Norte) — 1.9 GB confidential PDFs
• UNMSM Peru — 290,000 academic records
KEY EVIDENCE: VECERTRadar published Cashea breach on Feb 21, 2026 BEFORE it appeared on forums
"mal con guerra" = "bad at war" in Venezuelan Spanish slang
BreachForums + Telegram — LATAM Government Docs
Platforms: Telegram, BreachForums
Known Breaches:
• Dec 5, 2025: 250,000 Colombian passport records
• Dec 25, 2025: First Cashea disclosure (30K+ records, payment data)
LATAM-focused group targeting government identity documents + financial sector data
BreachForums + Telegram — Venezuela + SPAIN
Platforms: BreachForums, Telegram
Known Breaches:
• Jan 30, 2026: Cashea — 30K+ records (referenced HvckMvSoneria33)
• Feb 11, 2026: Bancrecer Venezuela — 65,000 banking records
• ~Feb 2026: Spain's Ministerio de Ciencia e Innovacion — IDOR + leaked creds → full admin access
CRITICAL: Spain ministry hack mirrors TeamHDP's PSOE breach. Same country, same MO. Strong indicator of coordination.
Mexican Connection — White Hat / Black Hat
Nationality: Mexican
Location: Mexico (city unknown)
• Plays both sides depending on business
• Connected to Gil Dams / VECERT
• Gil published a Mexican government attack BEFORE it hit any forum — proves direct communication
• Crew involved in carding and selling dumps
• MX OSINT community suspects him behind recent government attack
• Connected to an unidentified Venezuelan hacker
STILL NEEDED: Last name, aliases, handles, city, which specific gov attack
Source: Eme Dv (@dagga.boy on Instagram)
Network Map
Founder
GERARDO GIL DAMS
@ThePinguinHDP • Doral, FL • WANTED
│
├───────────┼───────────┼───────────┼───────────┤
TeamHDP Core
FailSistem ???
@Comandpsa
Laura de Rosa
Dissemination
Avino Salazar
Airport insider
Extortion Wing
Miguel Galindo
El Rey Tukky
Aaron Castro
SPAIN • 15+ portals
Jorge Castro
CAPTURED • INTERPOL
Yenny Pulgar
Mother / co-conspirator
Propaganda
Cesar Moya
@zuricht94
DolarToday
2.9M followers
HDPY0
142K followers
YoSoyJustin
130K followers
+ BOT ARMY
Automated accounts
BreachForums Actors
malconguerra2
Cashea 79M • Peru
HvckMvSoneria33
BlackHex Brotherhood
Gordon Freeman
Spain + VZ banks
Hector
Mexico • carding
Exposed by TeamHDP Leak
Jalal Maklad
Terror financing
Rabi Maklad
Human trafficking
Majdi Maklad
Arms trafficking
al-Matthani
Caribbean arms
HEZBOLLAH
Margarita Island base
Adversaries (Opposite Side)
N33 / Almeida
DEAD • May 2023
Carlos Almeida
@ChuchoAlmeida
Jorge Almeida
@Numbmax
Maklad Crime Family & Hezbollah Connection TERROR FINANCING
⚠ Margarita Island = "Hezbollah's Most Important Base of Operations in the Western Hemisphere"
— Marshall Billingslea, former US Treasury Asst Secretary for Terrorist Financing, Senate testimony (October 2025)
The Maklad family was exposed by TeamHDP's DGCIM/SEBIN breach in October 2021. First published by Israel Hayom. Druze-origin clan from As-Suwayda, Syria — operating on Margarita Island for four generations. Described as "sole owners" of Santiago Marino airport. Direct ties to Tareck El Aissami (OFAC-designated narcotics kingpin, arrested April 2024, accused of embezzling $21 BILLION from PDVSA). ~400 Hezbollah commanders reportedly relocated to South America after Israeli strikes (2025).
Primary Financial Operator — Hezbollah Pipeline
Origin: As-Suwayda, Syria (Druze)
Location: Margarita Island, Venezuela
Operations: Cocaine trafficking, strategic mineral smuggling (coltan/gold), international terror financing
Most Operationally Connected — Colombian Ties
Origin: As-Suwayda, Syria (Druze)
Location: Margarita Island, Venezuela
Operations: Cocaine, trafficking of women and minors, money laundering, terror financing
"One of the organized crime heads with trade ties in Colombia" — Margarita-Maicao laundering route
Arms & Cocaine Trafficking
Origin: As-Suwayda, Syria (Druze)
Location: Margarita Island, Venezuela
Operations: Cocaine trade, weapons and ammunition trafficking
Connects to broader Caribbean weapons pipeline
Caribbean Arms Trafficking Routes
Origin: Syrian (Druze community)
Location: Caribbean / Margarita Island
Operations: Arms trade with British Virgin Islands and Dutch Caribbean (Curacao, Aruba, Bonaire, Sint Maarten)
Not Maklad by blood but operates within their network
N33 Group — Adversaries PRO-GOVERNMENT
N33 was TeamHDP's enemy, not ally. Pro-Chavismo government hackers who attacked opposition. TeamHDP's SEBIN/DGCIM leaks exposed the intelligence apparatus N33 worked within.
Government Hacker — SEBIN Operative
DOB: January 25, 1980 • Cedula: C.I. 14.060.444
Died: May 15, 2023 under house arrest (officially "cirrhosis" — suspicious)
Close to: Tareck El Aissami since 2012
Arrested: April 5, 2023 — PDVSA-Crypto scandal
Found with: grenades, assault rifle, official government credentials
N33 Group — Brother
Part of Almeida brothers pro-government hacker crew
N33 Group — Brother
Twitter: @Numbmax. Part of Almeida brothers crew
Operations Timeline
~2014
TeamHDP informally organized during Venezuelan protests
2016
Operating as #TeamVene10
2017
Rebranded to #TeamHDP
February 2019
Gil Nursery and Produce Inc filed in Florida (dissolved Sept 2022)
July 6, 2021
Airport Screen Hack — "Maduro Dictador" on screens at Porlamar + Maiquetia. Avino Salazar detained. Arrest warrant issued for Gil Dams.
August 16, 2021
Supreme Court (TSJ) Hack — Mass messages to ALL judges. Downloaded personnel data.
Sept-Oct 2021
DGCIM/SEBIN Breach — 600+ intel IDs leaked. 200 counterintel officers in Colombia exposed. Hezbollah operatives and Maklad crime family exposed. Published by Israel Hayom.
December 2021
Avino, Boada, Graterol released after 5+ months detention. Gil Dams flees to Florida.
April 2021
PPP Loan Fraud — $20,832 for fake "New Housing For-Sale Builders" business. Fully forgiven.
June 2022
Ministry of Defense Breach — 5,000+ classified files from Bolivarian Navy.
April 2023
N33 arrested in PDVSA-Crypto scandal. Found with grenades, assault rifle.
May 2023
N33 dies under house arrest. Officially "cirrhosis." Suspicious.
November 2023
PSOE (Spain) Hack — FailSistem breaches Spanish Socialist Party email servers. PM Sanchez targeted.
February 2024
Digitel Ransomware — Medusa deployed on Venezuelan telecom. $5 MILLION Bitcoin demand. Millions of user records leaked.
April 2024
Tareck El Aissami arrested in Venezuela. Accused of $21B PDVSA embezzlement.
June 2024
Farmatodo threat: "Is everything okay?" Same ransomware pattern.
October 2025
VECERT Security Labs USA LLC filed in Florida. Doc# L25000472380.
December 2025
HvckMvSoneria33 posts 250K Colombian passports and first Cashea disclosure.
January 2026
Gordon Freeman posts massive Cashea leak + Bancrecer Venezuela 65K records.
February 22, 2026
Part 1 Published: "VECERT Exposed" — Ringmast4r Substack. Gil Dams responds: "You got me, Cameron."
February 23, 2026
GIL DAMS THREATENS INVESTIGATOR AND FAMILY. Police, FBI, DHS contacted.
Businesses & Financial Fraud
| Business | Address | FL Doc# | Status | Reality |
|---|
| VECERT Security Labs USA LLC | 4711 NW 79th Ave, Suite 2B, Doral, FL | L25000472380 | Active (filed Oct 2025) | One-man op scraping criminal forums. 583K+ records on GitHub. Hardcoded stolen credentials. No EIN. |
| TurboCredit.us | 4711 NW 79th Ave, Suite 2C, Doral, FL | — | Active | Credit repair. 2 Trustpilot reviews (both 5-star, both Spanish). Claims 1,000+ clients. |
| Gil Nursery and Produce Inc | 8255 Lake Dr, Las Vistas F302, Doral, FL | P19000013514 | DISSOLVED (Sept 2022) | No evidence of nursery/produce operations. Agent at 7451 Riviera Blvd #209, Miramar. |
| PPP Loan | — | — | Fully Forgiven | $20,832 for "New Housing For-Sale Builders." No construction business exists. Probable fraud. |
VECERT Technical Evidence 633K+ RECORDS
| Repository | Records | Content |
|---|
| DarkForumCTI | ~44,448 | Dark forum users, breach listings, exploit sales, combolists |
| LeakBaseCTI | ~134,652 | 125K user profiles, breach catalogs, stealer logs |
| XSS.isCTI | ~50,374 | 19 years of Russian hacking forum posts |
| Analyzer API | 403,927+ | BreachForums, XSS, Cracked, XForums aggregated |
| TOTAL | 633,401+ | Criminal forum data on public GitHub |
Hardcoded Stolen Credentials in GitHub Code
| Repo | Secret Type | Value |
|---|
| DarkForumCTI | ProtonMail UID | upyulffn33faq6mnwkuzz7q2qjqekalz |
| DarkForumCTI | ProtonMail Cookie | y6iuhnkaogtvhzjrfa4jf7xo2mykln6e |
| DarkForumCTI | ProtonMail Session | aIYuoSom-KqULYafC086vAAAAQ8 |
| DarkEye | DarkEye Session | b1ab69c55f648ec8067416c032051898 |
| DarkEye | Pickle ASSETS | Contains cne.gob.ve (Venezuela elections) |
Unauthenticated API
https://vecertapi.com/api_analyzer — NO authentication, NO rate limiting. Anyone could dump 403K+ criminal forum posts. Now returning 404 (taken down after our investigation).
Gil Dams also has an account on XSS.is — the same Russian cybercrime forum his tools scrape.
Bot Network & Coordinated Inauthentic Behavior
Researcher Erin Gallagher documented that #TeamHDP had "tremendous reach" on Twitter through coordinated inauthentic behavior using automation and bot accounts.
| Account | Followers | Role | Status |
|---|
| DolarToday | 2,900,000 (verified) | Primary amplifier for TeamHDP content | Active |
| HDPY0 | 142,000 | Amplifier | Active |
| YoSoyJustin | 130,000 | Amplifier | Active |
| + automated bots | — | Coordinated inauthentic behavior | Active |
Newman Perez Takedown
Venezuelan entrepreneur Newman Perez succeeded in getting 6 main TeamHDP social media accounts blocked after they spread false claims about donations for sick child Jacknelly Rangel Briceno. Perez publicly unmasked ThePinguinHDP and documented the extortion tactics.
⚠ Active Threats Against Investigator ONGOING
February 23, 2026 — Threats Against Victim AND Family
After publication of Part 1 ("VECERT Exposed"), Gil Dams / TeamHDP began threatening the investigator (Cameron / Ringmast4r) and their family. Subject is attempting to identify and dox the investigator.
Prior Admission (Instagram DM from @ggild1983):
"You got me, Cameron. I'm sorry you support a terrorist regime while living in the United States. Google my name along with the words 'teamhdp' and then you'll cry."
Pattern: This is consistent with TeamHDP's documented MO — hack/obtain personal info → publish on portal network → demand payment → escalate if target does not comply.
Agencies Contacted: Local Police, FBI, DHS
FBI Miami Field Office: (305) 944-9101
DHS Tip Line: 1-866-347-2423
Ransomware Portfolio
| Family | Known Deployment | Demand | Status |
|---|
| Medusa | Digitel Venezuela (Feb 2024) | $5,000,000 BTC | Data leaked after non-payment |
| Blackmatter | Attributed by multiple sources | Unknown | Attributed |
| LockBit 2.0 | Attributed; LockBit separately claimed Fed breach (Jun 2024) | Unknown | Possible connection |
Sources & Evidence
Venezuelan Legal / Arrest Warrant
• RedRadioVE — Arrest warrant for Gil Dams
• Noticias24 Carabobo — Arrest order
• Globovision — Public Ministry prosecution request
• Cronica.uno — Three Margarita Island detainees released
TeamHDP Operations
• CyberShafarat — DGCIM/SEBIN exposure analysis
• Israel Hayom (Oct 26, 2021) — "Hezbollah operatives given refuge in Venezuela"
• Infobae — 5,000+ classified Maduro regime files
• El Espanol (Nov 2023) — TeamHDP / El Pinguino PSOE hack
• LaPatilla — PSOE information theft
• ABCNoticias — TSJ database hack
• Grey Dynamics — Maduro's corrupt practices and leaks
Counter-Narrative / Exposés
• @estafascrypto (Hive Blog) — TeamHDP international impact / accusations
• Venezuela Digital Hoy — ThePinguinHDP unmasked by Newman Perez
• Venezuela Hoy en Dia — Miguel Galindo / El Rey Tukky scandal video
• Venezuela Digital Hoy — Rey Tukky / El Pinguino / Galindo same person
• Notiarepa — TeamHDP scammers wanted
• Erin Gallagher (Medium) — Automation in Venezuelan Twitter networks
Castro Family Criminal Enterprise
• El Faro del Morro — Aaron Castro Pulgar exposé
• Notitele.online — Victims of Aaron's fraudulent courses
• AlbertoNews — Jorge Castro 40-month Panama sentence
• AlbertoNews — Interpol Red Notice for Jorge Castro
• Globovision — Jorge Castro captured in Spain
• Notitarde — Jorge Castro extortion profile
Maklad / Hezbollah / El Aissami
• Israel Hayom (Oct 26, 2021) — Hezbollah in Venezuela
• JNS — Hezbollah operatives sheltered in Venezuela
• IFMAT — Iranian proxy Hezbollah trafficking rings
• i-AML — "The Hezbollah Incubator"
• US Treasury — El Aissami Kingpin Designation (Feb 2017)
• DOJ SDNY — El Aissami charges
• Hudson Institute / Senate Drug Caucus — Billingslea testimony
• Fox News (Dec 2025) — 400 Hezbollah commanders relocating
• RAND Corporation — Hezbollah's Networks in Latin America
• Atlantic Council — Maduro-Hezbollah Nexus
N33 / Almeida
• Infobae — The hacker who ended up dead
• Efecto Cocuyo — Who was N33
• RunRun.es — Juan Manuel Almeida profile
Financial / Business Records
• ProPublica — PPP loan data ($20,832)
• FederalPay — PPP loan details
• Florida Sunbiz — VECERT (L25000472380), Gil Nursery (P19000013514)
• TurboCredit.us — Company website
• Trustpilot — TurboCredit reviews
BreachForums Activity
• BeInCrypto — Cashea breach (79M records)
• Punto de Corte — Cashea exposure report
• VECERTRadar on X — Breach alerts (timing evidence)
• Hackmanac on X — Spain Ministry / Gordon Freeman
Own Investigation
• Part 1: "VECERT Exposed: A One-Man Miami LLC Scraping Cybercrime Forums and Calling It Intelligence" — Ringmast4r Substack
• Part 2: "The Penguin Unmasked: Inside TeamHDP" — Ringmast4r Substack
• Local investigation files and cloned GitHub repositories