Threat Actor Characterization
FINIX CYBER TEAM
ID: 00a00685c5ce3da9716e165c6881592692994| FCT | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
9f9ab2a2d4c5a8002326eac8fb84a615 | BD Anonymous Team | Bangladesh | ally-of | Hacktivist Group |
|
c0906172348a64540a747a1917b8745f89011 | Dead Killers | Cambodia | ally-of | Hacktivist Group |
|
16d87fbf38af7322872da1b9b2d37da2 | DigitalStormSec | Unknown | ally-of | Hacktivist Group |
|
ad41dfac8a37b1794d48653a8ee84f4722766 | KONCO ERROR SYSTEM | Indonesia | ally-of | Hacktivist Group |
|
342b834ad59056e351d395f8ac2b198965804 | Lolforum | Unknown | ally-of | Hacktivist Group |
|
5413f4c9f3f2b183570305903890bdea73713 | LunarisSec | Algeria | ally-of | Hacktivist Group |
|
820801e74174d7ee8171bcad71d1529a83748 | Order403 | Unknown | ally-of | Hacktivist Group |
|
57d375bbb3b9e83cda2b60492bbfb18b69719 | ShadowNex | Unknown | founder | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
FINIX CYBER TEAM is an emerging hacktivist / defacement-and-leak cluster with visible alliance activity, public branding, and limited but actionable signals of opportunistic web compromise and claim amplification.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
| T1585 | Establish Accounts | TA0042 | |
| T1567 | Exfiltration Over Web Service | TA0010 |
|
| T1595 | Active Scanning | TA0043 |
|
FINIX CYBER TEAM
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Hacktivism / Defacement and Leak Cluster
Origin: Unknown (possible Indonesia / Southeast Asia nexus, low-medium confidence)
Executive Summary
FINIX CYBER TEAM is best assessed as an emerging hacktivist and defacement-oriented cluster with public alliance activity, visible brand propagation, and limited but actionable signals of data-leak and public-compromise behavior. The strongest open-source anchors currently available are alliance announcements and archive-linked indicators that tie the brand to other hacktivist groups, alongside public defacement content referencing the team name.
The present evidence base does not support treating FINIX CYBER TEAM as a mature intrusion actor with a deeply documented malware toolchain or sustained post-compromise tradecraft. Instead, the observable picture is more consistent with a public-facing cluster that combines website compromise, defacement, leak amplification, and alliance signaling to build brand visibility and operational credibility inside a broader hacktivist ecosystem.
Recent public indicators place the group in an alliance-heavy environment. Open reporting and social-media alerts show public alliance announcements involving KONCO ERROR SYSTEM, Order403, BD Anonymous, and Digital Storm Sec during 2026. Public leak-related reporting also places the group in the broader anti-Israel / pro-Palestinian cyber-noise environment, although direct technical attribution for specific data-theft claims remains uneven.
