Cyber Threat Actor: Sangkancil

The threat actor known publicly as Sangkancil, also referred to as the Sangkancil Team, has been observed operating under aliases that appear in underground forums and breach announcements. Open‑source reporting indicates that the actor may be based in Indonesia, although no definitive location has been confirmed by authorities or the actor themselves. The moniker Sangkancil was first associated with a claim of a large‑scale data theft involving Israeli personal records in September 2021. Since that time the name has been reused in subsequent communications that reference the same actor or group.

According to the September 2021 announcement, Sangkancil asserted that it had exfiltrated approximately seven million records from the CITY4U platform, a service that aggregates municipal data for Israeli citizens. The leaked material reportedly included identity cards, driver’s licenses, tax bills and real‑estate documents, with the actor publishing sample images as proof of the breach. The actor framed the release as a “first surprise for the Jewish new year,” linking the timing to the Rosh Hashanah holiday and offering the full dataset for sale on a hacker forum without disclosing a price. In addition to the CITY4U claim, Sangkancil stated that it had gained access to a number of Israeli municipal systems, suggesting a broader interest in local government repositories.

No specific malware families, exploit tools or initial‑access vectors have been described in the publicly available sources related to Sangkancil’s activities, so any technical profile remains unspecified. Likewise, no public attribution to a state sponsor, criminal consortium or other affiliations has been made by law‑enforcement or intelligence agencies regarding this actor. The most concrete and publicly documented operation attributed to Sangkancil is the alleged CITY4U data theft and attempted sale, which serves as the primary reference point for understanding the actor’s behavior. All other details about the actor’s capabilities, motivations or future intentions are absent from the current open‑source record and therefore cannot be stated with certainty.