Coordinated campaigns in the digital realm have become an increasingly important area of study due to their potential to cause political polarization and threats to security through real-world protests and riots. In this paper, we introduce a methodology to profile two case studies of coordinated actions in Indonesian Twitter discourse. Combining network and narrative analysis techniques, this six-step pipeline begins with DISCOVERY of coordinated actions through hashtag-hijacking; identifying WHO are involved through the extraction of discovered agents; framing of what these actors did (DID WHAT) in terms of information manipulation maneuvers; TO WHOM these actions were targeted through correlation analysis; understanding WHY through narrative analysis and description of IMPACT through analysis of the observed conversation polarization. We describe two case studies, one international and one regional, in the Indonesian Twittersphere. Through these case studies, we unearth two seemingly related coordinated activities, discovered by deviating hashtags that do not fit the discourse, characterize the coordinated group profile and interaction, and describe the impact of their activity on the online conversation.