Loading threat actor…
IndoHaxSec is an Indonesian hacktivist collective aligned with pro-Palestinian and broader pro-Iran narratives. It has been identified as part of a globally distributed ecosystem of ideologically motivated groups that amplify cyber operations tied to the Israel-Palestine conflict and the wider Axis of Resistance information environment. Known aliases include indohaxsec and indohaxsec_team. The group has been associated with propaganda-driven cyber activity, public leak claims, and use of Telegram as a resilient coordination and dissemination platform. IndoHaxSec has been cited as maintaining backup Telegram channels to preserve continuity after moderation or takedowns, reflecting an operational model centered on rapid channel migration, audience retention, and sustained messaging. A notable claimed operation involved publication of a large dataset allegedly containing records of Israeli residents or voters, framed explicitly as support for Palestine and Iran. This behavior is consistent with hacktivist data-leak and influence-oriented operations in which publicity, ideological signaling, and reputational impact are central objectives. Available reporting supports exfiltration and post-compromise disclosure claims, but does not provide high-confidence detail on malware tradecraft, persistence mechanisms, or intrusion methodology beyond the group’s use of online platforms for coordination and release activity. IndoHaxSec is best characterized as a hacktivist actor motivated primarily by ideological alignment rather than financial gain. It appears within a broader network of non-state groups operating from Indonesia in support of anti-Israel and pro-Palestinian campaigns, and has been referenced as part of the expanding transnational cluster of pro-Iran-aligned hacktivist actors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Data-leak and defacement actor targeting Israeli civilian datasets and occasional US commercial websites for visibility and propaganda impact.
Uses Telegram channels as resilient infrastructure for cybercrime community presence and continuity (rapid channel migration when banned).
Pro-Iran hacktivist group operating from Indonesia as part of Iran’s globalized recruitment ecosystem.
Described as a pro-Palestinian hacktivist collective with an expanding network.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.