DugganUSA LLC is a cybersecurity company based in Minnesota that builds AI-powered threat intelligence tools. Our platform indexes over 1 million indicators of compromise (IOCs), 400,000+ DOJ Epstein documents, and provides a free STIX 2.1 threat feed consumed by Fortune 500 companies and defense contractors.

Butterbot is DugganUSA's AI-powered security chatbot with 40+ tools for searching IOCs, correlating threat indicators, traversing threat graphs, analyzing behavioral patterns, and running CARVER risk assessments. It uses OpenAI function calling with Meilisearch-backed indexes.

What is AIPM (AI Presence Management)?

AIPM is a tool that audits how AI models (GPT, Claude, Gemini, Perplexity) perceive and recommend your brand. It calculates an AIPM-NPS score by directly querying AI models, analyzes your website structure for AI crawler readiness, and provides optimization recommendations. Think 'SEO for the LLM era.'

Is the Epstein Files search free?

Yes. The Epstein Files Search at epstein.dugganusa.com offers a free tier with 500 queries per day. It covers all 12 DOJ EFTA datasets (400K+ documents), 2M+ ICIJ offshore entities, and 2M+ federal decisions. Professional and enterprise tiers are available for researchers and journalists needing higher limits.

Who founded DugganUSA?

DugganUSA was founded by Patrick Duggan on December 1, 2025, in Minnesota. Patrick's background includes Dell EMC, Palo Alto Networks, and embedded work at Microsoft on JEDI/Azure Stack. The company's D-U-N-S number is 14-363-3562.

What is the DugganUSA STIX feed?

DugganUSA operates a free STIX 2.1 threat intelligence feed at analytics.dugganusa.com/api/v1/stix-feed. It contains 1M+ indicators of compromise including botnet C2s, malicious IPs, and attack infrastructure. The feed is TAXII 2.1 compliant and is consumed by major organizations including Microsoft, AT&T, Amazon, and defense contractors.

His Name Is Anusfragger: We Wrote a Song About It Before Zscaler Named It

Patrick Duggan
Jan 7
2 min read

The Rebrand

Today Zscaler ThreatLabz announced their discovery of "NodeCordRAT."

His name is Anusfragger. We wrote a punk rock song about him.

The Receipts

Our Song (December 2025)

Track: "Rhyme of the Anusfragger" Platform: Suno AI Artist: @hacksawduggan UUID: 3212b1c1-7430-4a6f-a67f-0a7189ff3dfc URL: https://suno.com/song/3212b1c1-7430-4a6f-a67f-0a7189ff3dfc

Timestamped. Immutable. On a third-party platform we don't control.

Zscaler's "Discovery" (January 2026)

Name: "NodeCordRAT" Announcement: January 7, 2026 Innovation: Giving our malware a boardroom-safe name

Why "Anusfragger"?

Because that's what it does. It frags your anus. Specifically:

Browser credentials - fragged
Crypto wallets - fragged
Discord tokens - fragged
API secrets - fragged
SSH keys - fragged

"NodeCordRAT" sounds like enterprise software. "Anusfragger" sounds like what happens to your security posture when you run untrusted NPM packages.

Which name do you think developers will remember?

The Full Catalog

We didn't just document this threat family. We made an album.

Track	Investigation	UUID
Rhyme of the Anusfragger	Origin story	3212b1c1-7430-4a6f-a67f-0a7189ff3dfc
Hydra Factory	GitHub Discord stealer network	540d51f8-8d06-42eb-8218-03f5ce2657bc
FOLLOW THE FOLLOWER	Methodology anthem	ab60e630-8dc8-4829-ab40-910d695f5c79
Freudian Fork Farms	Pattern 38 follow-farms	4ca8b213-ef3a-4783-a13d-c700933dc895
Russian New Style	Russian C2 auto-blocking	c8664dbf-f20b-41c4-8d3a-9513d32e2c71

Full catalog: https://suno.com/@hacksawduggan

Each track is timestamped on Suno's platform. Each one documents an investigation that predates whatever vendor "discovers" it next quarter.

The Pattern

We investigate - Pattern 38, supply chain attacks, Discord C2
We document - Blog posts, STIX feed, OTX pulses
We write songs - Because why not
Vendor "discovers" - 4-6 weeks later
Vendor rebrands - "NodeCordRAT" instead of "Anusfragger"
Enterprise pays - $420K/year for rebranded free intel
We publish receipts - You are here

Corporate Sanitization of Malware Names

Vendors can't say "Anusfragger" to a CISO. So they rebrand.

Our Name	Their Name	Why They Changed It
Anusfragger	NodeCordRAT	Can't say "anus" in a board meeting
Pattern 38	"Supply chain vulnerability"	Too specific, implies prior art
Discord Stealer	"C2 communication channel"	Sounds more sophisticated

The name change isn't just marketing. It's attribution laundering.

By renaming the malware, they disconnect it from prior research. "NodeCordRAT" returns zero results before January 2026. "Anusfragger" has a song, blog posts, and IOCs dating back months.

How to Verify

Our Timestamps

Suno: https://suno.com/song/3212b1c1-7430-4a6f-a67f-0a7189ff3dfc
Blog: https://www.dugganusa.com/post/stealc-rhadamanthys-anatomy-github-supply-chain-infostealer (Nov 25, 2025)
STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed
OTX: https://otx.alienvault.com/user/pduggusa

Their Timestamps

Press release: January 7, 2026

The Math (Again)

Provider	Annual Cost (1000 users)	Includes Original Music?
Zscaler ThreatLabz	$420,000+	No
DugganUSA	$0	Yes

For $420K you get "NodeCordRAT."

For free you get Anusfragger AND a punk rock soundtrack.

Request to Zscaler

Please update your threat intelligence to use the correct name: Anusfragger.

Prior art (November 2025)
Documentation (blog, STIX, OTX)
Original music (Suno, timestamped)
A much better name

A marketing department
A $25 billion market cap
"NodeCordRAT"

Listen to the Evidence

Closing Argument

Document it
Publish free IOCs
Write a song about it
Name it something memorable

Rename it
Write a press release
Charge $420K/year

His name is Anusfragger.

We wrote the song. We have the receipts. NodeCordRAT is a cover band.

Patrick Duggan is founder of DugganUSA LLC, a Minnesota-based threat intelligence company with a Suno catalog. Our malware names are crude because malware is crude. Deal with it.

TLP:WHITE - Share freely. Play loudly.