Trenggalek Cyber Army

Trenggalek Cyber Army, prominently manifested through the alias trenggalek6etar, is a high-volume web-defacement cluster with a large 2026 footprint across compromised Joomla and WordPress sites. The strongest technical evidence links a major wave of trenggalek6etar defacements to exploitation of the Joomla Helix3 AJAX component vulnerability later tracked as CVE-2026-49049. Victim-side investigation documented unauthenticated requests to the Helix3 com_ajax endpoint, creation of cox.json defacement artifacts, injected template JavaScript, randomly named directories and PHP webshell/backdoor files. Repeated public pages carry the branding 'Hacked by Trenggalek6etar' and the JATIM4U greetz set. The cluster appears Indonesia-linked through naming and cultural markers, but operator origin should remain assessed rather than treated as proven.