Ransomware Group Behind Indonesian Data Center Attack Wears Many Masks

The threat actor behind a major attack on Indonesian government services is just one manifestation of an operation going by at least three other names.

On June 20, a ransomware operation known as "Brain Cipher" bit off more than it could chew when it locked up Indonesia's national data center. Hours-long lines began to form across the world's fourth-largest country as ferry passengers waited for booking systems to come back online, and international arrivals stood frozen at passport verification kiosks. Effects were felt throughout more than 200 national and local government agencies in all. Under pressure and with no promise of payment, the group abandoned its $8 million ransom demand, publishing its decryptor for free.

Researchers from Group-IB have since studied Brain Cipher and found that it's related to at least three other groups, or perhaps just operating under four different names. Together, these variously named entities have carried out attacks across the globe, but often without much consequence.

Brain Cipher's TTPs

Evidence of Brain Cipher's existence dates back only to its attack against the Indonesian government. Despite being so young, it already has spread to Israel, South Africa, the Philippines, Portugal, and Thailand. This, however, isn't necessarily proof of any degree of sophistication.

The malware it uses is based on the leaked Lockbit 3.0 builder. It has also used a variant of Babuk in the case of at least one Indonesian victim. "The use of varying encryptors allows threat actors to target multiple operating systems and environments," explains Tara Gould, threat research lead at Cado Security. "Different encryptors may be optimized for different operating systems which widens the scope of potential targets, ultimately maximizing the impact."

What its ransom notes lack in personality they make up for in clarity, with brief, step-by-step instructions on how to pay them for data recovery...

Continue reading this article on Dark Reading.