IamNoobie

Profile narrative

IamNoobie is the alias used by an individual who came to public attention in March 2021 after breaching the servers of the Philippine Civil Service Commission. The actor’s location is noted in open sources as the Philippines, although no further personal details have been disclosed. The breach resulted in the exposure of thousands of user details belonging to the commission’s users. The incident was reported by a news outlet that quoted the actor directly about his frustrations with government cybersecurity practices. According to the article, IamNoobie stated that he was pissed‑off with the way agencies implement security and decided to take matters into his own keyboard.

The actor described using Google dorking to locate potentially sensitive information on government websites. By employing search operators such as site: and filetype: the actor was able to uncover files and services that were not intended for public access. In addition to Google dorking, IamNoobie conducted passive scanning of the target’s infrastructure. Passive scanning allowed the identification of multiple vulnerabilities that could enable a full server takeover. No specific malware families or custom tooling were mentioned in the reporting of this incident. The actor’s approach relied on publicly available search techniques and network observation rather than bespoke exploit code.

Attribution to any state sponsor, criminal group or larger consortium has not been established in publicly available sources. The Civil Service Commission breach stands as the only publicly documented operation linked to IamNoobie at this time. Following the disclosure, the commission acknowledged the incident and stated that it had adopted remedial measures to address the identified weaknesses. The exposed data included personal details of users, though the exact volume and nature of the information were not elaborated beyond the description of thousands of records. No further campaigns or additional victims have been attributed to the alias in the open‑source record.

Incidents

Attributed incidents are available to members.