Overview

AnonSecKH, operating under aliases such as ANON-KH and Bl4ckCyb3r, is a politically motivated Cambodian hacktivist group. The group has intensified its activities following a border incident between Thailand and Cambodia in 2025, targeting Thai governmental, military, financial, and other sectors. They communicate and claim responsibility for attacks via Telegram channels under the Bl4ckCyb3r moniker, reflecting a coordinated effort driven by regional political disputes.

Types of Attacks

1. Distributed Denial of Service (DDoS) Attacks:

   • AnonSecKH has conducted DDoS attacks to disrupt the services of Thai entities, including the Office of the Education Council, Consumer Protection Board, King Power International Group, AUCT Corporation, and various ministries (e.g., Health, Interior, Agriculture, Higher Education, Tourism, and Sports). Links to check-host.net downtime reports (e.g., https://check-host.net/check-report/2ba1bfbfk670) confirm service unavailability.

   

2. Data Leaks and Exposure:

   • The group has leaked sensitive data, such as lists of eligible countries/territories for Thailand’s Annual International Training Course (AITC) 2023–2025 and military-related documents (e.g., Thai army ranks in vocab_soldier.pdf). This includes PDFs and CSV files (e.g., db6d6cc2-6a34-4aa5-b0e4-c7f7afe54f7b.csv), indicating access to administrative and military databases.

   

3. Defacement and Propaganda:

   • Website defacements and propaganda dissemination are key tactics, with messages urging supporters to share attack claims (e.g., https://t.me/addlist/iglFGIJ-jJE1Njk9). Hashtags like #OpThailand2025 highlight their political motivation.

Compromised Systems and Data

• Thai Government and Military Targets:

  • Attacks focus on Thai ministries and military infrastructure, with leaked data suggesting breaches into official systems managing training programs and ranks.

• Financial and Corporate Entities:

  • Targets like King Power International Group and AUCT Corporation indicate an expansion beyond government to financial and commercial sectors.

• Email and Contact Lists:

  • The 658a5a86a111a000aa48aa7781ad07512f0d2fc6621b97e03a4dbabf76c71656.txt file contains a large dataset of email addresses and IPs, likely harvested through phishing or system compromises, supporting their reconnaissance efforts.

  

Methods of Intrusion

1. DDoS and Service Disruption:

   • Utilization of DDoS techniques to overwhelm Thai government and corporate websites, as evidenced by downtime reports.

2. Data Exfiltration:

   • Extraction of structured data of the 👿National Intelligence Agency (NIA) - Thailand.

   

3. Social Media and Telegram Coordination:

   • The group leverages Telegram and Twitter for real-time updates, alliance building, and propaganda, using handles like anon_kh89.

   

Network and Affiliations

• Alliances:

  • AnonSecKH has formed a cyber alliance with groups like CyberWarriors Team and Anonymous Cyber Error System, as announced in the BLACK CYB3R channel, enhancing their operational capacity.

• Stealth Mole Analysis:

  • Network maps show connections to Telegram messages, media, and external links (e.g., https://twitter.com/kh872), indicating a decentralized yet interconnected structure.

  

Timeline of Activities

• 2025 Border Incident: Triggered heightened activity targeting Thailand.