Threat Actor Characterization
BadakSecTeam
ID: 9506ebd1236dfd0413701e17a96dee7040651| Badak Sec Team | BADAK SECURITY | Ba***************** | Ba*********** |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
9f9ab2a2d4c5a8002326eac8fb84a615 | BD Anonymous Team | Bangladesh | ally-of | Hacktivist Group |
|
c73578cdd6b5d5c8bac969b0092bf01b67879 | Komodoxploit | Unknown | member-of | Cybercrime |
|
ad41dfac8a37b1794d48653a8ee84f4722766 | KONCO ERROR SYSTEM | Indonesia | ally-of | Hacktivist Group |
|
|
9fb6d63b56b03372c481ef7c522fbe9668868 | T-Rex | Unknown | ally-of | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
BadakSecTeam is an emerging defacement-oriented cluster associated with repeated public-web compromise and page replacement activity observed in late March 2026.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1110 | Brute Force | TA0006 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T1580 | Cloud Infrastructure Discovery | TA0007 |
|
| T1583.001 | Domains | TA0042 |
|
BadakSecTeam — Preliminary Strategic Intelligence
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Cybercrime / Hacktivism / Defacement Cluster — Origin: Unknown; probable Indonesian / Southeast Asian nexus (INFERENCE, confidence: low-to-medium)
Author: iQBlack CTI Team
Executive Summary
BadakSecTeam is a small, recently visible defacement-oriented threat cluster with public archive footprint concentrated around late March 2026. Public evidence supports repeated website compromise and page-replacement activity, carried out under the team label “BadakSec Team” and associated most clearly with the public attacker handles Komodoxploit and T-Rex. The available evidence does not support advanced intrusion, durable persistence, or malware-centric operations.
The current public record suggests an opportunistic, web-facing compromise model focused on speed, scale, and proof-of-compromise visibility. Archive telemetry shows dozens of mirrored defacements across public websites, including multiple Mastodon/fediverse-adjacent domains and at least one Indonesia-labeled educational target. The activity pattern is more consistent with mass web vandalism and archive amplification than with disciplined access operations.
IOC Appendix — BadakSecTeam
This appendix summarizes currently usable indicators and behavioral patterns associated with BadakSecTeam. The public evidence base is still shallow and heavily weighted toward defacement archive telemetry rather than incident-response casework. As a result, most entries below are better suited for hunting, enrichment, and external exposure monitoring than for high-confidence blocking.
