{"id":5429,"date":"2026-10-18T08:55:32","date_gmt":"2026-10-18T08:55:32","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5429"},"modified":"2026-10-18T08:55:35","modified_gmt":"2026-10-18T08:55:35","slug":"palm-oil-ddos-alert-dsn-and-gapki","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/ddos\/palm-oil-ddos-alert-dsn-and-gapki\/","title":{"rendered":"Palm Oil DDoS Alert: DSN and GAPKI Fail 2 Global Checks"},"content":{"rendered":"\n

Two Indonesian palm oil industry<\/mark><\/strong> websites stopped answering most global connection tests on Saturday morning, October 17, 2026, during what the group Cyber Team Indonesia<\/mark><\/strong> presents as a palm oil DDoS campaign. The addresses were dsn.co.id<\/mark><\/strong>, the corporate site of plantation and timber company DSN Group, and gapki.id<\/mark><\/strong>, the site of the Indonesian Palm Oil Association. Two check-host reports, taken about 100 minutes apart, show most probe locations failing to connect to either one.<\/p>\n\n\n\n

The reports were posted by the group itself, so they are the attacker’s own evidence. They are still useful because each is timestamped and lists every probe location.<\/p>\n\n\n\n

\"Figure
Figure 1 : Palm oil DDoS campaign post by Cyber Team Indonesia targeting dsn.co.id, with a check-host report showing timeouts from most probe locations<\/figcaption><\/figure>\n\n\n\n

What the Screenshots Show<\/h2>\n\n\n\n

Both posts in this palm oil DDoS campaign follow one template. A banner for an operation called #OPINDO V3 sits on top, with the slogan “Bersama Jaga Hutan Kalimantan,” meaning “Together We Protect Kalimantan’s Forests<\/mark><\/strong>.” The artwork shows a forest engulfed in flames.<\/p>\n\n\n\n

Below it, each post carries the header ATTACK BY CYBER TEAM INDONESIA, the target address, a check-host link labeled PROOF, and a line reading TIMER: 200. The unit of that timer is not stated. A THANKS block then lists six hashtags, including #HADES_CYBER_CRIME, #RBL_LEVIATHAN_GHOST, #DisruptOr, #opsawit and #opcompanysawit. The last two translate loosely to “operation palm oil” and “operation palm oil company,” which makes the target industry plain.<\/p>\n\n\n\n

The counters on the palm oil DDoS posts read 290 views at 07:05 and 142 views at 08:27.<\/p>\n\n\n\n

\"Figure
Figure 2 : Cyber Team Indonesia logo showing an eagle with spread wings and the motto From Cyber to Brotherhood, tied to the palm oil DDoS campaign #OPINDO V3<\/figcaption><\/figure>\n\n\n\n

Target One: DSN Group (dsn.co.id)<\/h2>\n\n\n\n

DSN Group is the trading name of PT Dharma Satya Nusantara Tbk<\/mark><\/a><\/strong>, founded in 1980. It began in timber, then added palm oil and renewable energy. Its plantations are in East Kutai, East Kalimantan, and its shares trade on the Indonesia Stock Exchange as DSNG. That fits the Kalimantan theme of the banner, although the post gives no reason for picking this target.<\/p>\n\n\n\n

The first check-host run was recorded at 23:45:34 UTC on Friday, October 16, which is 06:45 WIB on Saturday. Of 40 probe locations visible, 37 returned “Connection timed out<\/mark><\/strong>.” One node in Isfahan, Iran, reported a reset, one in Tehran reported a refused connection, and a single node in Nyiregyhaza, Hungary, got through with an HTTP 200 after 3.614 seconds.<\/p>\n\n\n\n

That one success matters. Over three and a half seconds is slow for a corporate landing page, so the site was likely struggling rather than fully gone at that moment. Both Jakarta probes timed out, which suggests local visitors were affected too.<\/p>\n\n\n\n

Target Two: GAPKI (gapki.id)<\/h2>\n\n\n\n

GAPKI<\/mark><\/a><\/strong> is the trade body that speaks for palm oil producers on export policy, levies and sustainability certification such as ISPO. Its website is mainly a public information point, so an outage hits visibility more than operations.<\/p>\n\n\n\n

The second report in the palm oil DDoS series was recorded at 01:24:24 UTC on Saturday, or 08:24 WIB. Of 23 probe locations visible, 22 show “Connection reset by peer<\/mark><\/strong>,” including Sydney, Frankfurt, Hong Kong, Mumbai and both Jakarta nodes. The lone exception is Nyiregyhaza, which timed out. It is the same Hungarian node that succeeded against DSN about 100 minutes earlier.<\/p>\n\n\n\n

\"Figure
Figure 3 : Palm oil DDoS campaign post targeting gapki.id, with a check-host report showing connection reset by peer from most probe locations<\/figcaption><\/figure>\n\n\n\n

Palm Oil DDoS Data: Reading the Check-Host Results<\/h2>\n\n\n\n

Check-host sends a request from servers in many countries and reports what each one gets back. It is a snapshot of reachability at one moment, not a measure of traffic volume, and it cannot name an attack vector.<\/p>\n\n\n\n

The two reports fail in different ways. A timeout means packets never arrived or the reply never came back, which fits an overloaded link, a saturated server or traffic dropped upstream. A reset means the connection opened and was then closed abruptly by the server or a device in front of it, such as a firewall or load balancer applying rate limits. The mix hints at different hosting and protection setups, though the screenshots cannot confirm that.<\/p>\n\n\n\n

Treat the Iranian rows with caution, since nodes there often fail to reach foreign sites for reasons unrelated to any attack. With those set aside, the rest of the list still tells the same story. A single report also cannot show how long the outage lasted, and the TIMER: 200 line has no unit.<\/p>\n\n\n\n

Why a Palm Oil DDoS Campaign, and Why Now<\/h2>\n\n\n\n

The campaign pairs a forest protection message with a sector often discussed alongside deforestation. Hacktivist crews tend to pick targets by theme and then publish a DDoS result as proof. Here the credit block names three other handles beside the group’s own, which points to a joint effort rather than a single crew.<\/p>\n\n\n\n

The timing fits a wider trend. According to Kontan<\/mark><\/a><\/strong>, DDoS protection vendor StormWall reported in June 2026 that attacks on Indonesian organizations rose 62 percent year on year in the first quarter, with more than 280,000 mitigated. The same report put a financial motive behind about 70 percent of attacks, so a campaign with an environmental message is an outlier, even if the technique is the same.<\/p>\n\n\n\n

Read Here : related CyberAsia.io article on Indonesian<\/mark><\/a><\/strong> hacktivist DDoS campaigns<\/mark><\/a><\/strong>.<\/p>\n\n\n\n

What the Evidence Cannot Show<\/h2>\n\n\n\n

Nothing in the screenshots points to a data breach. A palm oil DDoS attack targets availability, not confidentiality, and a public corporate website is usually separate from plantation, mill and trading systems. The images also show no statement from DSN Group or GAPKI<\/mark><\/strong>, no traffic figures and no sign of when service returned. Until the organizations or their hosting providers say more, the accurate description is widespread unreachability, with the cause attributed by the group itself.<\/p>\n\n\n\n

Practical Steps for Site Operators<\/h2>\n\n\n\n

Sector websites can use this palm oil DDoS episode as a defense checklist.<\/p>\n\n\n\n

    \n
  • Put public sites behind a CDN or DDoS scrubbing service and keep the origin address private.<\/li>\n\n\n\n
  • Set rate limits and bot rules at the web application firewall, and test them before an incident.Monitor availability from<\/li>\n\n\n\n
  • Monitor availability from several regions, not only from inside Indonesia.<\/li>\n\n\n\n
  • Agree in advance with the hosting provider and ISP on who to call and what they can filter.<\/li>\n\n\n\n
  • Keep logs from the incident window and report serious events to BSSN, Indonesia’s national cyber agency.<\/li>\n<\/ul>\n\n\n\n

    FAQ<\/h2>\n\n\n\n

    Q1 : Were DSN Group or GAPKI hacked?<\/mark><\/strong><\/p>\n\n\n\n

    Nothing in the screenshots points to a breach. A DDoS attack floods a site with traffic to make it unreachable and does not by itself expose stored data.<\/p>\n\n\n\n

    Q2 : Does a check-host report prove a site was down for everyone?<\/mark><\/strong><\/p>\n\n\n\n

    No. It shows how the site answered probes in many countries at one moment. Routing problems and short congestion can also cause failures, so it is a strong hint, not final proof.<\/p>\n\n\n\n

    Q3 : What does “connection reset by peer” mean?<\/mark><\/strong><\/p>\n\n\n\n

    The remote side opened the connection and then ended it abruptly. Overloaded servers, firewalls and rate limits commonly do this under heavy traffic.<\/p>\n\n\n\n

    Q4 : What should an admin do first in a palm oil DDoS attack?<\/mark><\/strong><\/p>\n\n\n\n

    Call the hosting provider or ISP, enable upstream filtering or a CDN, tighten rate limits and preserve logs. Then post a short status notice for users.<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    Two Indonesian palm oil industry websites stopped answering most global connection tests on Saturday morning, October 17, 2026, during what the group Cyber Team Indonesia presents as a palm oil DDoS campaign. The addresses were dsn.co.id, the corporate site of plantation and timber company DSN Group, and gapki.id, the site of the Indonesian Palm Oil […]<\/p>\n","protected":false},"author":3,"featured_media":5430,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[1955,1656,2627,1184,2385,61,1188,14,1923,2873,2872,12,2787,1664,2788,2874,2871,1649,2381,1256,2007,2347,1263,1944,1696,1245,1395,2534,1160,1954],"threat_actors":[659],"class_list":["post-5429","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ddos","tag-an-ninh-mang","tag-berita-keamanan-siber","tag-check-host-2","tag-ciberseguridad","tag-cyber-security-news","tag-cyber-team-indonesia","tag-cybersecurite","tag-ddos-attack","tag-ddos-","tag-dsn-group","tag-gapki","tag-hacktivism","tag-kelapa-sawit","tag-keselamatan-siber","tag-minyak-sawit","tag-opindo-v3","tag-palm-oil-ddos","tag-serangan-ddos","tag-siber-guvenlik","tag-1256","tag-2007","tag-2347","tag-1263","tag-1944","tag-1696","tag-1245","tag-1395","tag-2534","tag-1160","tag-1954","threat_actor-cyber-team-indonesia"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=5429"}],"version-history":[{"count":3,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5429\/revisions"}],"predecessor-version":[{"id":5437,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5429\/revisions\/5437"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media\/5430"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=5429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/categories?post=5429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/tags?post=5429"},{"taxonomy":"threat_actor","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors?post=5429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}