Cyber Threat Actor: N33LOB33

N33LOB33 is the alias used by a hacker who has been linked to website defacements in Bangladesh. The actor’s location is noted as Bangladesh, based on the available reporting. No other aliases or affiliations have been publicly attributed to this individual or group. The threat actor first came to public attention through a series of incidents involving the Bangladesh Oil, Gas and Mineral Corporation’s online presence.

In April 2019, the official website of Petrobangla was defaced twice within a short period, with the hacker leaving a message that identified themselves as N33LOB33 and provided the email address [email protected]. The message stated that the site’s security was inadequate and that the actor was fixing the weaknesses without charge, while also indicating that a bounty would be accepted if offered. Communications with the actor revealed that no data had been exfiltrated from Petrobangla, but the actor claimed there was a large amount of information present on the server. The actor further volunteered that the next intended target was the Bangladesh armed force medical college, signaling a continuation of similar activities against other Bangladeshi institutions.

Based on the actor’s own statements, the observed activity involves website defacement intended to highlight perceived security deficiencies, with an expressed willingness to remediate vulnerabilities for free but also to accept financial compensation if provided. No details regarding malware families, initial access vectors, tooling, or broader campaign infrastructure have been disclosed in the source material. Consequently, the profile is limited to the confirmed facts surrounding the Petrobangla incidents and the actor’s self‑declared intentions, without extrapolation beyond the provided information.