Sangkancil

Profile narrative

Sangkancil, also known as Sangkancil Team, is a threat actor that has been linked to Indonesia based on available reporting. The actor emerged publicly in September 2021 when it claimed to have exfiltrated personal data from the CITY4U platform, asserting possession of records for approximately seven million individuals. The claimed data set included identity cards, driver’s licenses, tax bills and real estate documents, and the actor offered the archive for sale on a hacker forum while publishing sample images as proof. The actor referenced the Rosh Hashanah holiday in its announcement, indicating a temporal motive tied to the Jewish new year. Israel’s National Cyber Directorate initiated an investigation into the alleged breach, and preliminary assessments suggested the leaked material might consist of older records. In addition to the CITY4U claim, Sangkancil stated that it had successfully infiltrated a number of municipal systems, though no specific municipalities were named in the source material. The actor’s public actions point to a financially motivated objective, as the primary stated goal was to sell the stolen data set.

Regarding tactics, the only observable behavior described in the reporting is the acquisition and exfiltration of personal data followed by the publication of screenshots to validate the claim and the subsequent offering of the data for sale on an underground forum. No malware families, initial access vectors, or specific tooling styles are mentioned in the available sources, so no further technical details can be attributed to the actor. Attribution to any state sponsor or criminal consortium is not established in the reporting, and no affiliations are explicitly cited. The most notable operation attributed to Sangkancil remains the claimed breach of CITY4U and the associated assertion of access to multiple Israeli municipal databases, which represents the actor’s sole publicly reported campaign to date. No additional incidents or broader patterns of activity are documented in the provided material.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.