Wednesday , June 25 2025
computer lab

Ransomware detail behind Indonesia’s data center breach

Indonesia’s temporary National Data Center (PDN) was attacked by ransomware last Thursday, leading to delays in airport immigration services and new student registration. The hackers are asking for an $8 million ransom, about Rp 131 billion, to give back the stolen data.

The ransomware used in this incident is “Brain Cipher”. Lieutenant General Hinsa Siburian, the Head of the National Cyber and Encryption Agency (BSSN), stated that Brain Cipher is an updated version of the LockBit 3.0 ransomware. In 2023, the LockBit hacker group also targeted and disrupted the systems of Bank Syariah Indonesia (BSI).

WhatsApp banned on all US House of Representatives devices

The U.S. House of Representatives has banned congressional staff from using WhatsApp on government devices due to security concerns, as...
Read More
WhatsApp banned on all US House of Representatives devices

Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

Kaspersky found a new mobile malware dubbed SparkKitty in Google Play and Apple App Store apps, targeting Android and iOS....
Read More
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store

OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

OWASP has released its AI Testing Guide, a framework to help organizations find and fix vulnerabilities specific to AI systems....
Read More
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems

Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

In a major milestone for the country’s digital infrastructure, Axentec PLC has officially launched Axentec Cloud, Bangladesh’s first Tier-4 cloud...
Read More
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform

Hackers Bypass Gmail MFA With App-Specific Password Reuse

A hacking group reportedly linked to Russian government has been discovered using a new phishing method that bypasses two-factor authentication...
Read More
Hackers Bypass Gmail MFA With App-Specific Password Reuse

Russia detects first SuperCard malware attacks via NFC

Russian cybersecurity experts discovered the first local data theft attacks using a modified version of legitimate near field communication (NFC)...
Read More
Russia detects first SuperCard malware attacks via NFC

Income Property Investments exposes 170,000+ Individuals record

Cybersecurity researcher Jeremiah Fowler discovered an unsecured database with 170,360 records belonging to a real estate company. It contained personal...
Read More
Income Property Investments exposes 170,000+ Individuals record

ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel's IKE affecting UDP port 500. The attack centers around CVE-2023-28771,...
Read More
ALERT (CVE: 2023-28771)  Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

CISA Flags Active Exploits in Apple iOS and TP-Link Routers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included two high-risk vulnerabilities in its Known Exploited Vulnerabilities (KEV)...
Read More
CISA Flags Active Exploits in Apple iOS and TP-Link Routers

10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

SafetyDetectives’ Cybersecurity Team discovered a public post on a clear web forum in which a threat actor claimed to have...
Read More
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online

“This ransomware is continuously being developed. This (Brain Cipher) is the latest version we’ve seen through samples,” Hinsa Siburian said on Monday.

About brain chiper:

According to David Sehyeon Baek,

Tor Domains:
In the world of cybercrime, Brain Cipher is a dangerous threat. They use Tor hidden services to operate with high security and anonymity. This means that their identity and interactions with victims are kept secret. Recently, two Tor domains linked to Brain Cipher have been discovered.

– mybmtbgd7aprdrnw2ekxht5gap5daam2wch25coqerqz2dionb34ad.onion

– vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

Operational Areas:
Brain Cipher’s operations are divided into distinct areas for managing various illicit activities.

Brain Cipher Client Area:
This part is used for first interactions with victims. It’s where ransom demands and payment instructions are given. It’s the first contact and negotiation to make sure the victim knows the consequences of not following the demands.

Brain Cipher Leaks:
Brain Cipher threatens to expose personal data from victims who don’t pay ransoms, making them feel pressured to comply. This tactic aims to force victims into meeting the demands.

Communication Channels:
Brain Cipher uses various secure channels for communication to stay in touch with their victims and discuss terms.

Email Contact:
– Email: [email protected]

This email address functions as a support or negotiation channel, allowing victims to communicate directly with Brain Cipher operatives.

TOX IDL:
– TOX ID: BEBA1CBBD4C1D6DFCB788024174FDE6AE6137C7835FBF997CB178DB5697AE574FB6055381095

TOX is a secure instant messaging protocol used for private communications, making it a popular choice for negotiations and support.

Detailed Information About the Favicon Used:
Brain Cipher’s operations extend to the minute details of their infrastructure. The favicon used on their sites offers critical insights.

– File Name: favicon.ico

– MD5 Hash: c9ca7163c8433b64dac54e6f74aea3df

– SHA1 Hash: 5f97acc13a2b7c51b4cebf3354b3f228dc876307

– SHA256 Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

– File Path: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– Scanned Date: 2024-06-26 11:28:41

– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Technical Infrastructure:
The technical infrastructure supporting Brain Cipher is robust and carefully concealed.

– URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– Scanned Date: 2024-06-26 11:28:41

– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Brain Cipher Client Area:
– Tor: mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

– Tor URL: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/assets/img/favicon/favicon.ico

– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

A new domain with the same favicon.ico hash was discovered:

– Tor URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico

– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a

Brain Cipher Leaks
– Tor: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

The Director General of Applications and Informatics at the Communication and Informatics Ministry, Semuel Abrijani Pangerapan, mentioned that measures to isolate data have been taken to deal with the cyber attack. The government is actively working on restoring the public services that have been affected by the disruption.

Last Thursday, June 20, there was a cyber attack that caused significant disruptions to the immigration office’s online services throughout the past week. The attack also impacted the online announcement of new student registration results (PPDB).

By mid-2024, ten major institutions, both private and government, have been targeted by ransomware attacks. These institutions operate in various sectors such as logistics, shopping centers, consumer finance, banks, financial services, IT services, transportation, and stock brokerage firms, according to data from IT security company Vaksincom.

((Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)

Check Also

GreyNoise

ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs

GreyNoise found attempts to exploit CVE-2023-28771, a vulnerability in Zyxel’s IKE affecting UDP port 500. …

Leave a Reply

Your email address will not be published. Required fields are marked *