Overview

• Group Name: NRSTSEC
• Associated Email: [email protected] with password NRSTSEC1285
• Activity Period: Breaches and leaks span from 2023 to 2025, with recent activity noted in August 2025.
• Communication Channels: Primarily via Telegram (nrstsec_official), with additional context from leaked combo files linked to private cloud services.

Types of Attacks

1. DDOS Attack:

   • Downed https://www.tnnthailand.com/ on August 4, 2025, with a report at https://check-host.net/check-report/2b0f9647k12f.

   

   • Zone-XSEC records 11 total defacements, including homepages.

   

2. Data Breaches and Credential Leaks:

   • The email [email protected] appears across multiple compromised data sets (CDS, CB, UB), with passwords like NRSTSEC1285. This suggests a targeted or opportunistic harvesting of credentials.
   • Leaked documents (redcloud.txt, MIXED.txt, 100K CELESTIAL PRIVATE UP FROM LOGS 1.txt, etc.) contain over 100,000 credential pairs, indicating a large-scale data breach operation, potentially involving NRSTSEC or affiliated groups.
   • 93 compromised entries for [email protected], with passwords like nengzin1285, leaked since February 20, 2023.

   

3. Social Engineering:

   • Targeted login pages (e.g., Google, GitHub) and Android URLs suggest phishing campaigns.

     

     

Compromised Systems

• Victims: TNN Thailand, personal accounts (Amazon, Roblox), IPs in Cambodia and Southeast Asia.
• Systems: Windows machines (e.g., Administrator, CH-202211021849).

Methods of Intrusion

• Weak Credentials: Exploits reused passwords via brute force or stuffing.
• Social Engineering: Channel invites as potential phishing vectors.
• Malware/Stealers: Use of "Stealc" infostealer for credential extraction.
• Defacement Tools: Likely SQL injection or file inclusion vulnerabilities.

Motivations and Affiliations

• Hacktivism: Hashtags (#Joaland, #OPTHAILAND) suggest Cambodia-Thailand conflict motives.
• Reputation: Rank 1366 on Zone-XSEC, public claims for notoriety.