3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Babacang07

Babacang07

ID: 8e493b4ee601ca1f53cd0d39a67c0bdc
Hacktivist Group Defacement Crew Hacktivism
Threat types: Defacement, WebShell
Indonesia ALB, ARM, BRA, CHL, CCK, IND, IDN, LSO, PAK, PRY, RUS, ZAF, ESP, LKA, TTO, GBR
Updated: 2026-01-19
Created: 2025-10-16
Progress: 65% Completeness: 71% Freshness: 50%
Operation zone: Albania, Armenia, Brazil, Chile, Cocos(Keeling)Islands, India, Indonesia, Lesotho, Pakistan, Paraguay, Russia, South Africa, Spain, Sri Lanka, Trinidad and Tobago, United Kingdom
Aliases Limited alias preview
./Babacang07 ardian1337 De******** Fl*****
Fr***** — — —
Showing 2 of 5 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Babacang07 — Indonesian web-defacer active at least 2020–2025, publicly associated with team PhantomSec1337; earlier activity appears under the alias 'DemonNipon' affiliated with Ganest Seven (notified 2022). OSINT shows overlapping periods where both handles were in use, suggesting dual affiliation or transitional branding common in the Indonesian defacement scene.


Technique Technique name Tactics Evidence
T1491.002 External Defacement TA0040
  • 2020-11-09 — Defacement archived with notifier 'Babacang07' and team 'PhantomSec1337' (page shows /1337.htm landing). · ref
  • 2022-05-02 — Multiple Indonesian government subdomains defaced under alias 'DemonNipon' with team 'Ganest Seven' (mass run). · ref
  • 2025-03-03 — DefacerID incident: Pseudonym 'Babacang07', Team 'PhantomSec1337' (report page for starpowercorporation.com). · ref
T1585 Establish Accounts TA0042
  • 2020-11-25 — Public social presence of PhantomSec1337 featuring #Babacang07 (group identity/reputation management). · ref
  • 2025 — Team ranking pages list PhantomSec1337 (Top 10) and Ganest Seven among leading defacement crews (branding and outreach). · ref
Strategic Intelligence
Limited preview
Last updated: 2025-10-16T21:43:37+00:00
Babacang07 (Indonesia) — Defacement-Focused Operator

CLASSIFICATION: Unclassified / Open Source


Executive Summary

Babacang07 is an Indonesian defacer observed in public archives 2020–2025 under PhantomSec1337, with earlier appearances as “DemonNipon” aligned to Ganest Seven (notably in 2022). This alias transition/overlap fits long-standing patterns in the Indonesian defacement scene, where operators rotate banners while maintaining similar tradecraft. Evidence consists of Zone-Xsec mirrors tying Babacang07 → PhantomSec1337, DemonNipon → Ganest Seven, and DefacerID incident cards citing Babacang07/PhantomSec1337 through 2025. Technical specifics are sparse beyond external defacement, though frequency/volume metrics place the actor within high-tempo mass defacement culture. Overall confidence: medium (handles, teams, and dates are corroborated in public archives; initial access vectors are not described).


  • 2020-11-09. Zone-Xsec domain page shows a defacement by Babacang07 under PhantomSec1337 (landing /1337.htm).
  • 2020-11-25. PhantomSec1337 Instagram posts featuring #Babacang07 (public branding).
  • 2022-05-02/03. DemonNipon (alias) conducts a mass run for Ganest Seven, including Indonesian kab.go.id subdomains and Japan-hosted WordPress targets (multi-entries in the archive page).
  • 2025-03-03. DefacerID incident lists Pseudonym: Babacang07; Team: PhantomSec1337 for a U.S.-hosted target (incident card).
  • 2025. Notifier stats show Babacang07 among top individual defacers by volume in 2025 (DefacerID yearly stats).
  • 2025 (context). Team ranks list PhantomSec1337 in the Top 10 crews and Ganest Seven in the Top 5 by total defacements, indicating sustained team-level volume.
Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Empty Limited preview
No content yet.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Empty Limited preview
No content yet.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Empty Limited preview
No content yet.
IOC Appendix now
Saved successfully.
OSINT Library
Empty Limited preview
No content yet.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/8
Address Verification SOCMINT
t.me/Fro**** Restricted Not integrated
t.me/Fla**** Restricted Not integrated
t.me/Fla******** Restricted Not integrated
t.me/bab******* Restricted Not integrated
t.me/Dem******* Restricted Not integrated
t.me/Web********* Restricted Not integrated
t.me/+Mx************** Restricted Not integrated
Address Verification SOCMINT
ar********@yahoo.com Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–6 of 6 images
Hacked website evidence Free Preview
Hacked website evidence
Hacked website evidence Free Preview
Hacked website evidence
Hacked website evidence Free Preview
Hacked website evidence
Hacked website evidence Free Preview
Hacked website evidence
Hacked website evidence Free Preview
Hacked website evidence
Hacked website & group affiliation evidence Free Preview
Hacked website & group affiliation evidence
Showing 4 of 6 images in preview mode. Additional evidence is restricted for Analyst and Premium plans.