{"id":451,"date":"2024-09-20T07:05:43","date_gmt":"2024-09-20T13:05:43","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=451"},"modified":"2024-09-20T07:05:47","modified_gmt":"2024-09-20T13:05:47","slug":"ransomware-attack-on-indonesias-national-data-center","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2024\/09\/20\/ransomware-attack-on-indonesias-national-data-center\/","title":{"rendered":"Ransomware Attack on Indonesia\u2019s National Data Center"},"content":{"rendered":"\n

In June 2024, a ransomware attack broke into the National Data Centre in Indonesia and interrupted major services across the nation. The attackers who appear to be part of a ransomware attack group \u2018LockBit\u2019 demanded a ransom of US$ 8 million [1]. The Brain Cypher ransomware was shrouded in several forms and deployed in the national data centre. As a result, Indonesia was temporarily brought to a standstill. Immigration services were affected as most services were temporarily jammed even in airports where all document management systems fell leading to the loss of vital data [2]<\/p>\n\n\n\n

Who\/What is Brain Cipher<\/h4>\n\n\n\n

Brain Cipher is a relatively new ransomware operation that made headlines after their malware breached the National Data Centre of Indonesia. They probably created their virus through the leaked LockBit 3.0 builder, as the ransomware they used is almost an exact clone of the builder[4].
Brain Cipher didn\u2019t include the ransom amount or wallet address in the ransom note, only a link to a Tor-hosted communication page with those details. Brain Cipher also has its own site on which it lists leaks, but it appears it\u2019s only being used for live victims in order to pressure them into paying the ransom demanded.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Figure 2: Brain Cipher\u2019s Incomplete Leak Site and Communication Page [3]<\/p>\n\n\n\n

LockBit Ransomware: What Is It?<\/h4>\n\n\n\n

The vicious LockBit ransomware locks the victim\u2019s computer files and demands payment to unlock them, after seizing and encrypting the files. The LockBit ransomware first appeared in 2019 and operates as a ransomware-as-a-service (RaaS) business where affiliates receive the ransomware, create vulnerabilities in a target, then encrypt files and split ransom rewards with LockBit operators. Industries that have, and will continue to be, targeted by LockBit include healthcare, industrial and financial services. LockBit is noted for how quickly they can encrypt files and maintain stealth [3].<\/p>\n\n\n\n

Immediate Repercussions<\/h4>\n\n\n\n

The strike was felt against the wide-ranging array of government departments that provide digital services for passports, visas, immigration, and residency permits. The retaliation to the attack was widespread and fast. Immigration services in Indonesia were slowed down and disrupted for travellers at the nation\u2019s main airport. Foreign nationals and citizens had problems getting through border security, getting issued a visa, and other essential immigration services, resulting in huge queues forming at the airport [2].<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Source from X [7]<\/p>\n\n\n\n

What was done to stop the attack?<\/h4>\n\n\n\n

They had to back up critical data to Amazon Web Services to get the whole unit functioning again and to do more diagnostics.
In the wake of the hack, the Indonesian government immediately launched a nationwide audit to evaluate the security of data held in all of Indonesia\u2019s national data centres, to identify any possible weak points that could have enabled an attack like this one, and to try to ensure so that this doesn\u2019t happen again. Some key areas of attention include:<\/p>\n\n\n\n