Cyber Threat Actor: 3musketeerz
| Actor Type | Location | Known Incidents |
Sensationalist
|
Philippines
|
1 incident |
|---|
Profile
The threat actor knownby the alias 3musketeerz has been observed operating from the Philippines. The group’s only publicly documented activity to date is a website defacement that occurred on 14 October 2023. This activity was attributed to the actor after they uploaded a meme bearing the text “you’ve been hacked” to the compromised site. No other aliases or geographic locations have been confirmed in open sources.
The target of the defacement was the official website of the Philippine House of Representatives, accessible at congress.gov.ph. On the day of the incident the homepage was replaced with the aforementioned meme, rendering the original content unavailable to visitors. The House of Representatives immediately took the site offline to prevent further unauthorized access and reported the breach to the Department of Information and Communications Technology. The DICT confirmed the compromise and assigned its Philippine National Computer Emergency Response Team to investigate the incident.
As part of the investigation CERT‑PH is examining whether any sensitive data was accessed during the breach. The DICT also issued security recommendations to the House of Representatives IT team to help prevent similar incidents in the future. Once the technical analysis is complete, the Cybercrime Investigation and Coordinating Center and law‑enforcement agencies will conduct threat‑actor attribution and build a case for possible legal action. The DICT has stated that it will continue to work with government agencies to strengthen the security of their information and communications technology infrastructure.
No details regarding malware families, initial‑access vectors, or specific tooling used by 3musketeerz have been disclosed in the reported sources. Similarly, no public information links the actor to a state sponsor, criminal consortium, or any broader campaign beyond the single defacement. The available evidence therefore limits the profile to the confirmed alias, Philippine location, and the October 2023 website defacement of the House of Representatives.