Brandefense analysts wrote this mid-year 2024 report on cyber threats to Indonesia. It looks at six sectors: government, defense, finance, energy, telecommunications and aviation. The chapters cover dark web activity, stolen credentials, fraud and phishing, ransomware, and hacktivist DDoS attacks. Ransomware is malware that encrypts files so systems become unusable (CISA). Phishing is electronically delivered social engineering (MITRE ATT&CK).
The full Indonesia Cybersecurity Threat Landscape & Strategic Insights Report runs 61 pages and opens with an executive summary.
Attention on Indonesia grew during the half year. The report puts 58.8% of dark web chat mentions of the country in the second quarter, and counts around 15 Indonesian organizations hit by ransomware, across government, defense, finance, energy, telecommunications, and aviation and other sectors.
What Are the Key Highlights of the Indonesia Cybersecurity Threat Landscape Report?
- Rising Dark Web Activity: more Indonesian organizations named on underground forums, with forum posts peaking in April 2024.
- Compromised Credentials: botnet infections and third-party data breaches in banking, energy, the public sector, telecom, aviation and defense.
- Fraud & Phishing: phishing pages, smishing campaigns and misuse of Indonesian citizens’ personal data.
- Ransomware Threats: attacks that disrupted finance, manufacturing, telecom, retail and IT companies.
- Hacktivism & DDoS: politically motivated campaigns, such as OpIndonesia, against public and private institutions.
The sections below sum up what each chapter says, with the numbers the report gives.
What Does the Indonesia Cybersecurity Threat Landscape Report Cover?
The mid-year 2024 report runs 61 pages and is prepared by the Brandefense Analyst Team. After an executive summary, it follows the threats chapter by chapter.
- Dark web activity: how often “Indonesia” appears in dark web chats and on underground forums.
- Compromised credentials: botnet infections and third-party breaches, sector by sector.
- Phishing, social engineering and fraud cases.
- The ransomware landscape.
- DDoS and hacktivist threats.
- Mitigation and recommendations.
What Does the Report Say About Dark Web Activity?
The report says 58.8% of “Indonesia” mentions in dark web chats came in the second quarter of 2024, against 41.2% in the first. On underground forums, it says post counts peaked in April 2024. The most common post type was an organizational data leak. Stolen credentials sharing came second.
How Does the Report Treat Compromised Credentials?
It explains that infostealer infections and third-party breaches both feed underground channels. It says the sector analysis rests on research into 10 active organizations in each selected sector.
What Does the Report Say About Phishing and Fraud?
It shows a phishing page that mimics an Indonesian bank. It also covers scams that use a company name, such as fake job offers sent in the name of PT Pertamina.
What Does the Report Say About Ransomware and Hacktivism?
The report says around 15 organizations in Indonesia were targeted by ransomware in the first half of 2024. It gives a month-by-month list by industry and attacking group. For example, a telecommunications company is listed under Stormous.X and a finance company under Trigona for January. The report notes that finance was heavily targeted in January, February and April.
The hacktivist section describes a DDoS attack tied to the “OpIndonesia” campaign. It also classes one claimed ransomware case as hacktivism, because of the actors’ motives.
What Defenses Does the Report Recommend?
- Avoid pirated software and unverified downloads.
- Use strong passwords and turn on multi-factor authentication.
- Secure web applications that hold sensitive data, with patching and a web application firewall.
- Prepare network measures against DDoS and hacktivist attacks.
Our incident page on the 2023 Bank Syariah Indonesia cyberattack covers a LockBit claim against an Indonesian bank that the bank did not confirm.