The ANN thread owner did do bumping services but it not mostly done by the Vitor Services cause some project owner do it by themselves, I an saying this cause I have seen a lot of fiveer users who offers services in selling forum account which I think they can easily buy and pump the ANN themselves, either way, it could the work of Vito but they are not always behind it.
Well of course they are not the only ones that are offering bumping, I know that there are many of them offering services via Fiverr, but somehow I doubt those have access to Newbie accounts made in 2011. When you look at these cases long enough you start noticing some patterns. As I said, it looks like them but I can't be 100 sure that they are behind Upwork bumping but in the end it doesn't matter much who exactly is doing that.
The 'workbit' thread is likely connected to the guys with malware wallets/fake miners, i mean it has to be one of theirs, all of the evidence leads to them.
It's either them, or maybe they have the same account supplier. Someone had to think in advance and make all those accounts back in the early bitcointalk days and probably is selling them in bulk. Looks to me like they have unlimited amount of those old accounts as no matter how many of them get banned, new ones are constantly popping up.
But I think you might be onto something here as I see Workbit ANN has been
reported yesterday to have malware link so hopefully it gets deleted soon.