Hacktivist group

Ustad Cyber Team

Ustad Cyber Team (UCT) is an Indonesian group operating @[redacted], with a second channel @[redacted] and an older channel identified by the group as @[redacted]. The current channel explicitly self-labels as '#Defacer Indonesia', and HaxorID preserves a USTAD CYBER TEAM team entry while a currently indexed compromised page displays 'Hacked By Ustad Cyber Team'. UCT is also an active alliance hub: FalconFeeds and partner-channel records preserve alliances with ATZENT, RBL LEVIATHAN GHOST, DEWATA BLACKHAT, BROTHERHOOD CAPUNG and GARUDA KERNEL ERROR SYSTEM. A substantial portion of current channel content consists of forwarded access sales, webshell-market advertising, data-market posts and hacking-tool offers originating from third parties. These forwarded materials demonstrate marketplace amplification and ecosystem connectivity, not necessarily UCT ownership of the access, datasets or tooling.

INFERENCE (confidence: high): UCT is both a defacement actor and an alliance/amplification hub inside the Indonesian hacktivist ecosystem.

INFERENCE (confidence: high): forwarded access, webshell and database sales should remain attributed to the original sellers unless UCT independently claims ownership or execution.

INFERENCE (confidence: high): alliance density is operationally important because it can increase target discovery, claim propagation and community resilience even when member capabilities differ.

Created by iQBlack CTI Team
Contributors 1
Last updated 2026-08-28

ATT&CK

MITRE ATT&CK

T1491.002External Defacement
T1585.001Social Media Accounts

Research

Selected OSINT