InfoSecBulletin Cybersecurity for mankind
Indonesia’s temporary National Data Center (PDN) was attacked by ransomware last Thursday, leading to delays in airport immigration services and new student registration. The hackers are asking for an $8 million ransom, about Rp 131 billion, to give back the stolen data.
The ransomware used in this incident is “Brain Cipher”. Lieutenant General Hinsa Siburian, the Head of the National Cyber and Encryption Agency (BSSN), stated that Brain Cipher is an updated version of the LockBit 3.0 ransomware. In 2023, the LockBit hacker group also targeted and disrupted the systems of Bank Syariah Indonesia (BSI).
Intel PC, laptop and server processors affected for 6 years: Report
CVSS 10.0 Flaw
Critical flaw in Siemens OZW Web Servers Enable Unauthenticated RCE
Microsoft Patch Tuesday May 2025: 72 flaws, 5 Actively Exploited Zero-Day
OTP glitch disrupted NID services across the country
Google to pay Texas $1.4 billion for location tracking practices
YouTube geo-blocks at least 4 Bangladeshi TV channels in India
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
“This ransomware is continuously being developed. This (Brain Cipher) is the latest version we’ve seen through samples,” Hinsa Siburian said on Monday.
About brain chiper:
According to David Sehyeon Baek,
Tor Domains:
In the world of cybercrime, Brain Cipher is a dangerous threat. They use Tor hidden services to operate with high security and anonymity. This means that their identity and interactions with victims are kept secret. Recently, two Tor domains linked to Brain Cipher have been discovered.
– mybmtbgd7aprdrnw2ekxht5gap5daam2wch25coqerqz2dionb34ad.onion
– vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
Operational Areas:
Brain Cipher’s operations are divided into distinct areas for managing various illicit activities.
Brain Cipher Client Area:
This part is used for first interactions with victims. It’s where ransom demands and payment instructions are given. It’s the first contact and negotiation to make sure the victim knows the consequences of not following the demands.
Brain Cipher Leaks:
Brain Cipher threatens to expose personal data from victims who don’t pay ransoms, making them feel pressured to comply. This tactic aims to force victims into meeting the demands.
Communication Channels:
Brain Cipher uses various secure channels for communication to stay in touch with their victims and discuss terms.
Email Contact:
– Email: [email protected]
This email address functions as a support or negotiation channel, allowing victims to communicate directly with Brain Cipher operatives.
TOX IDL:
– TOX ID: BEBA1CBBD4C1D6DFCB788024174FDE6AE6137C7835FBF997CB178DB5697AE574FB6055381095
TOX is a secure instant messaging protocol used for private communications, making it a popular choice for negotiations and support.
Detailed Information About the Favicon Used:
Brain Cipher’s operations extend to the minute details of their infrastructure. The favicon used on their sites offers critical insights.
– File Name: favicon.ico
– MD5 Hash: c9ca7163c8433b64dac54e6f74aea3df
– SHA1 Hash: 5f97acc13a2b7c51b4cebf3354b3f228dc876307
– SHA256 Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a
– File Path: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico
– Scanned Date: 2024-06-26 11:28:41
– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a
Technical Infrastructure:
The technical infrastructure supporting Brain Cipher is robust and carefully concealed.
– URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico
– Scanned Date: 2024-06-26 11:28:41
– Content Hash: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a
Brain Cipher Client Area:
– Tor: mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion
– Tor URL: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion/assets/img/favicon/favicon.ico
– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a
A new domain with the same favicon.ico hash was discovered:
– Tor URL: http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion/assets/img/favicon/favicon.ico
– SHA256: e440bf227e56e62f4616fe4ac7b0df2c67d94fe1127acf2d6a27ab2ebb085d5a
Brain Cipher Leaks
– Tor: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion
The Director General of Applications and Informatics at the Communication and Informatics Ministry, Semuel Abrijani Pangerapan, mentioned that measures to isolate data have been taken to deal with the cyber attack. The government is actively working on restoring the public services that have been affected by the disruption.
Last Thursday, June 20, there was a cyber attack that caused significant disruptions to the immigration office’s online services throughout the past week. The attack also impacted the online announcement of new student registration results (PPDB).
By mid-2024, ten major institutions, both private and government, have been targeted by ransomware attacks. These institutions operate in various sectors such as logistics, shopping centers, consumer finance, banks, financial services, IT services, transportation, and stock brokerage firms, according to data from IT security company Vaksincom.
((Media Disclaimer: This report is based on research conducted internally and externally using different ways. The information provided is for reference only, and users are responsible for relying on it. Infosecbulletin is not liable for the accuracy or consequences of using this information by any means)
