Overview
KOLzSec, identified as a hacktivist group, appears to be actively engaged in cyber operations targeting governmental and institutional websites, primarily in Thailand. The group operates under the handle "@KOLzSec" and is associated with other hacking collectives such as #NXBBSEC, #AnonSecKH, #blackcyber, and #NullSec Philippines. The data suggests a coordinated effort to conduct defacements, Distributed Denial of Service (DDoS) attacks, and possibly data breaches, with a focus on promoting justice-related narratives, particularly concerning Cambodia.
Key Findings
Types of Attacks
- Website Defacement (Lei$): Multiple instances of website defacement are reported, where the group alters the content of targeted sites to display their messages or logos. Examples include the Chiang Mai Provincial Administrative Organization site and over 100 Thai government sites.
- DDoS Attacks: Evidence of DDoS attacks is present, notably the takedown of the National Broadcasting and Telecommunications Commission (NBTC) of Thailand has been down, with check-host.net reports confirming downtime.
- Potential Data Breaches: References to "proofs" and "check" links suggest that the group may have accessed and exfiltrated data, though specific details on breached data are not fully disclosed in the provided messages.
Compromised Systems
- Governmental Websites:
- The group claims to have targeted these systems as part of operations like #OpThailand, indicating a strategic focus on Thai infrastructure.
Methods of Intrusion
- Exploitation and Defacement: The group likely exploits vulnerabilities in web applications or servers to gain unauthorized access, followed by defacing the sites with their branding (e.g., the KOLzSec logo featuring a suit and question mark).
- DDoS Campaigns: Utilization of botnets or coordinated traffic to overwhelm target servers, as seen with the Ministry of Defense and official Thailand site takedowns.
- Proof of Concept: Links to check-host.net reports (e.g., https://check-host.net/check-report/2b9e3f11k45b) are provided to verify downtime or defacement, suggesting a methodical approach to document their attacks.
- Collaboration: Mentions of #NullSec Philippines and #JusticeforCambodia indicate possible collaboration with other hacktivist groups, potentially sharing tools or resources.