Le Duc Hoang Hai

Profile narrative

Le Duc Hoang Hai, also known simply as Hai, is a Vietnamese individual identified as the perpetrator of a cyber intrusion against Perth Airport’s computer systems. He is located in Vietnam and has been described as a skilled hacker who acted alone in the incidents that have been publicly reported. Authorities in Vietnam convicted him in a military court and sentenced him to four years of imprisonment following the breach. The actor’s aliases appear in both law enforcement reports and media coverage detailing the attack on the Australian airport. No public evidence links him to any larger criminal organization or state‑sponsored group.

His targeting has included critical infrastructure in both Vietnam and Australia, with the Perth Airport incident involving the theft of building schematics and physical security details from the airport’s networks. In addition to the airport, Hai reportedly attacked Vietnamese banks, telecommunications services and an online military newspaper, indicating a focus on sectors that support national economic and informational functions. The Perth Airport chief executive stated that it appeared the man had been attempting to steal credit card data, while a cybersecurity adviser noted that the stolen data comprised a significant amount of sensitive security information related to the facility. These statements indicate that his objectives have encompassed both financial gain attempts and the acquisition of security‑relevant data, though no evidence shows that he sold or disseminated the stolen material.

The primary technique referenced in the reporting is the use of a third‑party contractor’s credentials to gain initial access to the victim’s systems, a method that does not rely on malware or custom tooling as described in the sources. No specific malware families, exploit kits or distinctive tooling styles are mentioned in the available material. Attribution assessments have found no indication that Hai was working with a broader group or receiving direction from a state entity, and the Vietnamese legal proceedings treated him as an independent actor. The most notable publicly reported operation remains the March intrusion into Perth Airport, which prompted an international investigation involving Australian federal agencies and Vietnamese law enforcement, while his activities against domestic Vietnamese targets represent a complementary pattern of behavior.

Incidents

Attributed incidents are available to members.