Gantengers Crew

Profile narrative

Gantengers Crew, also known simply as Gantengers, is an Indonesian hacking group that has been active since at least 2014. The actors operate from Indonesia and are recognized by the aliases they use in defacement messages, such as SultanHaikal, d3b~X, Brian Kamikaze, Coupdegrace, Mdn_newbie and NG689Skwng689skwyahoocom. Their public activity consists primarily of website defacements where they replace target homepages with pages bearing their online handles and short statements. The group does not appear to be linked to any state sponsor or criminal consortium in the available reporting.

Their targeting spans multiple sectors and geographic regions, including government sites such as the Kenyan president’s official portal, financial services exemplified by the MasterCard Online Resources domain, educational institutions like Australian National University, environmental non‑governmental organizations including WWF and Earth Hour Philippines, and cloud‑based services such as Canonical’s Ubuntu One platform. The actors have repeatedly stated that their goal is to demonstrate the insecurity of targeted servers, to show that financial data is not safe, to prove that nothing is fully secured and to challenge the credibility of other hackers. These statements indicate a strategic focus on disruption and reputation rather than financial gain or espionage.

Observed tactics involve exploiting web vulnerabilities to gain unauthorized access to web servers and uploading defacement pages, although in the Ubuntu One case the actors merely uploaded an image file that resembled a defacement page through the service’s legitimate file‑sharing function, which the provider later determined was not a true breach. After each incident the group provides proof of the defacement by linking to Zone‑H mirrors of the altered pages. No malware families, specific exploit kits, or custom tooling are mentioned in the sources, and the actors do not appear to employ persistent access or data exfiltration techniques.

Attribution remains limited to the group’s self‑identification as an Indonesian collective, with no public evidence of state affiliation or membership in a larger criminal network. Notable operations include the May 2015 defacement of Kenya’s presidential website, the April 2015 alteration of MasterCard’s Online Resources domain, the January 2015 series of EC‑Council sub‑domain compromises, the February 2014 attacks on WWF and Earth Hour Philippines sites, and the January 2014 Ubuntu One domain incidents. Each of these actions was accompanied by a defacement message bearing the crew’s aliases and a brief claim of demonstrating vulnerability.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 5 sources.