Threat Actor Characterization
IndoXploit
ID: 7b4939a8af28c814f0c757bb10f40d3d61533Actor Network Graph
Open Network GraphMITRE ATT&CK®
IndoXploit — Indonesian hacking/defacement community active since at least 2017. Public indicators include a GitHub org (indoxploit-coders) linked to indoxploit.or.id and the widely documented ‘IndoXploit PHP Shell’ used to compromise LAMP/CMS stacks. Mirrors on Zone-H tie the notifier ‘IndoXploit’ to multiple defacements through 2022.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 | |
| T1491.002 | External Defacement | TA0040 |
|
| T1585 | Establish Accounts | TA0042 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
IndoXploit operates as a community/crew with a dual footprint: (1) a development side producing/maintaining the IndoXploit PHP shell (2017), and (2) a defacement footprint visible in Zone-H mirrors (2017–2022). The shell is documented by vendors as post-exploitation tooling on LAMP/CMS stacks, implying a tradecraft path of public-facing app exploitation → webshell drop → content replacement. Confidence: medium (vendor advisories + mirrors + verified GitHub org).
- 2017-09–11. Alert Logic details IndoXploit PHP Shell capabilities and usage post-exploitation.
- 2017–2022. Zone-H shows repeated IndoXploit defacement mirrors.
- 2025. GitHub org “indoxploit-coders” verified; links to indoxploit.or.id.
- T1190 – Exploit Public-Facing Application. Observed via shell’s intended use on CMS/LAMP.
- T1491.002 – Defacement (External). Mirrors attributed to IndoXploit notifier.
- T1585 – Establish Accounts/Presence. Public developer org and site branding.