Threat Actor Characterization
NotraSec
ID: 452045af12adcddef437f5ccd3dee69e67191| NotraSec Team | Team NotraSec | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
NotraSec is a small emerging defacement-oriented cyber-vandalism cluster with public Telegram presence, named members, and repeated defacement archive visibility. Current open reporting supports opportunistic public-web compromise and website content manipulation rather than advanced intrusion or mature criminal operations.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1110 | Brute Force | TA0006 |
|
| T1565.001 | Stored Data Manipulation | TA0040 | |
| T1580 | Cloud Infrastructure Discovery | TA0007 |
|
NotraSec
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Cybercrime / Hacktivism / Defacement Cluster — Origin: Probable Indonesia / Southeast Asia nexus (INFERENCE, confidence: medium)
Author: iQBlack CTI Team
Executive Summary
NotraSec is a small but publicly visible defacement-oriented threat cluster with Telegram presence, named members, and archived mass-defacement activity. The group is best assessed as an emerging low-complexity web-compromise and web-vandalism collective rather than a mature intrusion actor. Publicly observable activity centers on opportunistic website compromise, branded page replacement, archive visibility, and narrative amplification.
Available evidence supports treating NotraSec as a real operating identity rather than a purely speculative name. Public indicators include a Telegram channel branded as “NOTRASEC TEAM,” a separate public invite/group reference, member naming embedded in defacement content, and a repeatable archive footprint across defacement-tracking services. However, available reporting does not support claims of sustained access operations, advanced malware development, or high-confidence geopolitical alignment.
OSINT Library — NotraSec
2026-03-09 — Dark Web Informer — "Threat Attack Update - March 9th, 2026"
https://darkwebinformer.com/threat-attack-update-march-9th-2026/
