Wednesday , June 4 2025
computer lab

Ransomware detail behind Indonesia’s data center breach

Indonesia’s temporary National Data Center (PDN) was attacked by ransomware last Thursday, leading to delays in airport immigration services and new student registration. The hackers are asking for an $8 million ransom, about Rp 131 billion, to give back the stolen data.

The ransomware used in this incident is “Brain Cipher”. Lieutenant General Hinsa Siburian, the Head of the National Cyber and Encryption Agency (BSSN), stated that Brain Cipher is an updated version of the LockBit 3.0 ransomware. In 2023, the LockBit hacker group also targeted and disrupted the systems of Bank Syariah Indonesia (BSI).

CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

IBM has issued a security advisory for vulnerabilities in its QRadar Suite Software and Cloud Pak for Security platforms. These...
Read More
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed

ALERT
Thousands of IP addresses compromised nationwide: CIRT warn

As Bangladesh prepares for the extended Eid-ul-Adha holidays, the BGD e-GOV Computer Incident Response Team (CIRT) has issued an urgent...
Read More
ALERT  Thousands of IP addresses compromised nationwide: CIRT warn

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

“This ransomware is continuously being developed. This (Brain Cipher) is the latest version we’ve seen through samples,” Hinsa Siburian said on Monday.

About brain chiper:

According to David Sehyeon Baek,

Tor Domains:
In the world of cybercrime, Brain Cipher is a dangerous threat. They use Tor hidden services to operate with high security and anonymity. This means that their identity and interactions with victims are kept secret. Recently, two Tor domains linked to Brain Cipher have been discovered.

– mybmtbgd7aprdrnw2ekxht5gap5daam2wch25coqerqz2dionb34ad.onion

– vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

Operational Areas:
Brain Cipher’s operations are divided into distinct areas for managing various illicit activities.

Brain Cipher Client Area:
This part is used for first interactions with victims. It’s where ransom demands and payment instructions are given. It’s the first contact and negotiation to make sure the victim knows the consequences of not following the demands.

Brain Cipher Leaks:
Brain Cipher threatens to expose personal data from victims who don’t pay ransoms, making them feel pressured to comply. This tactic aims to force victims into meeting the demands.

Communication Channels:
Brain Cipher uses various secure channels for communication to stay in touch with their victims and discuss terms.

Email Contact:
– Email: [email protected]

This email address functions as a support or negotiation channel, allowing victims to communicate directly with Brain Cipher operatives.

TOX IDL:
– TOX ID: BEBA1CBBD4C1D6DFCB788024174FDE6AE6137C7835FBF997CB178DB5697AE574FB6055381095

TOX is a secure instant messaging protocol used for private communications, making it a popular choice for negotiations and support.

Detailed Information About the Favicon Used:
Brain Cipher’s operations extend to the minute details of their infrastructure. The favicon used on their sites offers critical insights.

– File Name: favicon.ico

– MD5 Hash: c9ca7163c8433b64dac54e6f74aea3df

– SHA1 Hash: 5f97acc13a2b7c51b4cebf3354b3f228dc876307

– SHA256 Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

– File Path: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– Scanned Date: 2024-06-26 11:28:41

– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Technical Infrastructure:
The technical infrastructure supporting Brain Cipher is robust and carefully concealed.

– URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– Scanned Date: 2024-06-26 11:28:41

– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Brain Cipher Client Area:
– Tor: mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

– Tor URL: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/assets/img/favicon/favicon.ico

– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

A new domain with the same favicon.ico hash was discovered:

– Tor URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Brain Cipher Leaks
– Tor: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

The Director General of Applications and Informatics at the Communication and Informatics Ministry, Semuel Abrijani Pangerapan, mentioned that measures to isolate data have been taken to deal with the cyber attack. The government is actively working on restoring the public services that have been affected by the disruption.

Last Thursday, June 20, there was a cyber attack that caused significant disruptions to the immigration office’s online services throughout the past week. The attack also impacted the online announcement of new student registration results (PPDB).

By mid-2024, ten major institutions, both private and government, have been targeted by ransomware attacks. These institutions operate in various sectors such as logistics, shopping centers, consumer finance, banks, financial services, IT services, transportation, and stock brokerage firms, according to data from IT security company Vaksincom.

((Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)

Check Also

Evaly

Evaly E-commerce Platform Allegedly Hacked

Evaly, a Bangladeshi e-commerce platform, is reportedly facing a major data breach that may have …

Leave a Reply

Your email address will not be published. Required fields are marked *