INDOHAXSEC – Emerging Indonesian Hacking Collective

## Executive Summary: Arctic Wolf Labs identified and profiled an Indonesian-based hacktivist collective called INDOHAXSEC active since late 2024 that conducts DDoS attacks, website defacements, ransomware deployments and doxxing across the Indo-Pacific; the report details their toolkits (GitHub-hosted scripts and malware such as Dancokware and ExorLock), communication channels (Telegram, TikTok, X), observed targeting (India, Israel, Malaysia), and provides a set of IoCs (SHA256 hashes) and detection recommendations to protect affected organizations.