Recently, a shocking incident occurred that resulted in the disruption of immigration services and various other public services. The disruption stemmed from a cyberattack carried out by Brain Cipher Ransomware.

The&nbsp;Pusat Data Nasional (PDN)&nbsp;was the main target of this attack since June 20. The cyberattack has crippled essential services like immigration services, leading to another impact on 210 instantiations. Although some services have been restored, the impact is still felt.

The&nbsp;Badan Siber dan Sandi Negara (BSSN)&nbsp;and related institutions immediately responded to this incident. Emergency measures were taken by sending an assistance team to the data center in Surabaya. The PDNS was built as an alternative because the main&nbsp;Pusat Data Nasional (PDN)&nbsp;is not yet completed.

The responsible party for this attack demanded a ransom of USD 8 million (approximately Rp 131 billion) to restore access to the system.

For context, PDN is managed by Telkom Group through Telkom Sigma. Telkom Indonesia’s Network &amp; IT Solution Director, Herlan Wijanarko, confirmed the ransom demand. However, the compensation process is still under evaluation.

In parallel with the recent events, the Brain Cipher Ransomware is an emerging threat actor currently focusing on organizational targets. The following analysis details the methods, indicators of compromise (IOCs), and tactics used by this ransomware group.

Brain Cipher Ransomware is delivered primarily through phishing campaigns. These campaigns often use deceptive emails to trick recipients into downloading and executing malicious files.

SHA1: 935c0b39837319fda571aa800b67d997b79c3198

- SHA256: eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

- SSDEEP: 3072/5qUpfDT6zT73Ew8Ym9wV9JyknP7SAy

- IP Addresses: 199.232.214.172 (US), 224.0.0.252

- Web: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

- VirusTotal:<a href="https://www.virustotal.com/gui/file/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12">VirusTotal Link</a>

- T1204.002: User Execution Malicious File

- T1555.003: Credentials from Web Browsers

The Brain Cipher Ransomware employs sophisticated techniques to infiltrate, propagate, and encrypt data within targeted networks. Its primary delivery method is through phishing emails, which often contain malicious attachments or links leading to malware downloads.

Once inside a network, the ransomware utilizes various tactics to escalate privileges, evade defenses, and gain access to sensitive information. For instance, it uses Windows Command Shell for execution and bypasses user account control for privilege escalation.

The ransomware's discovery tactics include querying the registry, discovering system information, and software discovery. These actions allow the ransomware to map out the infected environment and identify high-value targets for encryption.

Credential access is a significant aspect of Brain Cipher's methodology. It steals web session cookies, credentials from web browsers, and credentials stored in files, providing the attackers with the necessary information to further infiltrate the network or exfiltrate data.

Finally, the ransomware's impact tactic is data encryption, which renders the victim's data inaccessible until a ransom is paid. This tactic is effective in causing significant disruption to organizational operations, as seen in the recent attack on Indonesia's National Data Center.

To mitigate the threat posed by Brain Cipher Ransomware and similar attacks, organizations should adopt a multi-layered security approach. This includes:

- Email Security: Implementing robust email security solutions to detect and block phishing attempts.

- User Training: Regularly training employees to recognize and report phishing emails.

- Endpoint Security: Deploying advanced endpoint protection to detect and prevent malware execution.

- Network Segmentation: Segregating critical systems and data to limit the spread of ransomware.

- Backup Solutions: Maintaining regular backups of critical data and ensuring that backups are stored securely and offline.

- Incident Response Planning: Developing and regularly updating incident response plans to ensure a swift and effective response to ransomware attacks.

Enhancing Your Cybersecurity with Peris.ai

As cyber threats continue to evolve, it becomes increasingly important for organizations to stay ahead of potential attacks. Peris.ai offers advanced cybersecurity solutions designed to anticipate and defend against such threats. One such measure is&nbsp;<a href="https://www.peris.ai/product-services/ganesha/phisland">Peris.ai's Phisland</a>, a sophisticated phishing simulator designed to safeguard your digital frontier.

Phisland is a comprehensive phishing simulator that provides your organization with the tools to stay ahead of cyber threats. By simulating phishing attacks via email, websites, and WhatsApp, Phisland helps enhance your team's security awareness and overall cybersecurity posture.

Realistic Simulations: Phisland offers a suite of realistic phishing simulations that mimic real-world attacks. By tracking user interactions with these simulations, Phisland enables organizations to identify vulnerabilities and opportunities for improvement in real-time.

Enhance Security Awareness: Phisland stands out with its ability to analyze and interpret user responses intelligently. Through advanced algorithms and customizable analytics, Phisland distils vast amounts of data into actionable intelligence, helping organizations create targeted and effective strategies to enhance their security awareness and resilience against cyber threats.

Embrace Phisland to proactively strengthen your cybersecurity measures and protect your organization from potential phishing attacks.

The recent ransomware attack on Indonesia's National Data Center underscores the escalating threat of ransomware and the profound impact such incidents can have on public services. The emergence of threats like Brain Cipher Ransomware further emphasizes the necessity for robust cybersecurity measures to guard against evolving cyber threats.

Organizations must remain vigilant, continually updating their security practices and staying informed about the latest threat intelligence to effectively combat ransomware attacks.

For comprehensive solutions to enhance your cybersecurity posture and protect against these threats, visit&nbsp;<a href="https://www.peris.ai/">Peris.ai Cybersecurity</a>. Explore our wide range of products and services designed to keep your organization secure in an ever-changing digital landscape. Don't wait—safeguard your digital assets with Peris.ai today!

<p>Peris.ai, a group of practitioners with professional experience in cybersecurity, revealed in more detail about the Cipher Brain ransomware that has attacked the Temporary National Data Center since last June 20.</p> <img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/d85ec879-771a-45dc-6967-256db8309100/public" alt="Image" /><p>Recently, a shocking incident occurred that resulted in the disruption of immigration services and various other public services. The disruption stemmed from a cyberattack carried out by Brain Cipher Ransomware.</p><p>The&nbsp;Pusat Data Nasional (PDN)&nbsp;was the main target of this attack since June 20. The cyberattack has crippled essential services like immigration services, leading to another impact on 210 instantiations. Although some services have been restored, the impact is still felt.</p><p>The&nbsp;Badan Siber dan Sandi Negara (BSSN)&nbsp;and related institutions immediately responded to this incident. Emergency measures were taken by sending an assistance team to the data center in Surabaya. The PDNS was built as an alternative because the main&nbsp;Pusat Data Nasional (PDN)&nbsp;is not yet completed.</p><p>The responsible party for this attack demanded a ransom of USD 8 million (approximately Rp 131 billion) to restore access to the system.</p><p>For context, PDN is managed by Telkom Group through Telkom Sigma. Telkom Indonesia’s Network &amp; IT Solution Director, Herlan Wijanarko, confirmed the ransom demand. However, the compensation process is still under evaluation.</p><h2>Brain Cipher Ransomware: An Overview</h2><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/3a827b1b-c7e0-4f6c-c3b5-10875c2c1a00/public" alt="Image" /><p>In parallel with the recent events, the Brain Cipher Ransomware is an emerging threat actor currently focusing on organizational targets. The following analysis details the methods, indicators of compromise (IOCs), and tactics used by this ransomware group.</p><h3>Method of Delivery: Phishing</h3><p>Brain Cipher Ransomware is delivered primarily through phishing campaigns. These campaigns often use deceptive emails to trick recipients into downloading and executing malicious files.</p><h3>Indicators of Compromise (IOCs)</h3><p>- MD5: 448f1796fe8de02194b21c0715e0a5f6</p><p>SHA1: 935c0b39837319fda571aa800b67d997b79c3198</p><p>- SHA256: eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12</p><p>- SSDEEP: 3072/5qUpfDT6zT73Ew8Ym9wV9JyknP7SAy</p><p>- IP Addresses: 199.232.214.172 (US), 224.0.0.252</p><p>- Web: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion</p><p>- Email: brain.support@cyberfear.com</p><p>- VirusTotal:<a href="https://www.virustotal.com/gui/file/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12">VirusTotal Link</a></p><h3>MITRE ATT&amp;CK&nbsp;</h3><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/c8aabfb4-658a-4693-ab70-24c72fede100/public" alt="Image" /><h4>Execution</h4><p>- T1059.003: Windows Command Shell</p><p>- T1204.002: User Execution Malicious File</p><h4>Privilege Escalation</h4><p>- T1548.002: Bypass User Account Control</p><h4>Defense Evasion</h4><p>- T1548.002: Bypass User Account Control</p><h4>Credential Access</h4><p>- T1539: Steal Web Session Cookies</p><p>- T1555.003: Credentials from Web Browsers</p><p>- T1552.001: Credentials in Files</p><h4>Discovery</h4><p>- T1012: Query Registry</p><p>- T1082: System Information Discovery</p><p>- T1518: Software Discovery</p><h4>Impact</h4><p>- T1486: Data Encryption for Impact</p><h3>Detailed Analysis</h3><p>The Brain Cipher Ransomware employs sophisticated techniques to infiltrate, propagate, and encrypt data within targeted networks. Its primary delivery method is through phishing emails, which often contain malicious attachments or links leading to malware downloads.</p><p>Once inside a network, the ransomware utilizes various tactics to escalate privileges, evade defenses, and gain access to sensitive information. For instance, it uses Windows Command Shell for execution and bypasses user account control for privilege escalation.</p><p>The ransomware's discovery tactics include querying the registry, discovering system information, and software discovery. These actions allow the ransomware to map out the infected environment and identify high-value targets for encryption.</p><p>Credential access is a significant aspect of Brain Cipher's methodology. It steals web session cookies, credentials from web browsers, and credentials stored in files, providing the attackers with the necessary information to further infiltrate the network or exfiltrate data.</p><p>Finally, the ransomware's impact tactic is data encryption, which renders the victim's data inaccessible until a ransom is paid. This tactic is effective in causing significant disruption to organizational operations, as seen in the recent attack on Indonesia's National Data Center.</p><h3>Mitigation and Response</h3><p>To mitigate the threat posed by Brain Cipher Ransomware and similar attacks, organizations should adopt a multi-layered security approach. This includes:</p><p>- Email Security: Implementing robust email security solutions to detect and block phishing attempts.</p><p>- User Training: Regularly training employees to recognize and report phishing emails.</p><p>- Endpoint Security: Deploying advanced endpoint protection to detect and prevent malware execution.</p><p>- Network Segmentation: Segregating critical systems and data to limit the spread of ransomware.</p><p>- Backup Solutions: Maintaining regular backups of critical data and ensuring that backups are stored securely and offline.</p><p>- Incident Response Planning: Developing and regularly updating incident response plans to ensure a swift and effective response to ransomware attacks.</p><h3>Enhancing Your Cybersecurity with Peris.ai</h3><p>As cyber threats continue to evolve, it becomes increasingly important for organizations to stay ahead of potential attacks. Peris.ai offers advanced cybersecurity solutions designed to anticipate and defend against such threats. One such measure is&nbsp;<a href="https://www.peris.ai/product-services/ganesha/phisland">Peris.ai's Phisland</a>, a sophisticated phishing simulator designed to safeguard your digital frontier.</p><h4>What is Ganesha - Phisland?</h4><p>Phisland is a comprehensive phishing simulator that provides your organization with the tools to stay ahead of cyber threats. By simulating phishing attacks via email, websites, and WhatsApp, Phisland helps enhance your team's security awareness and overall cybersecurity posture.</p><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/b75c142d-04ba-4a39-58bd-b66b60ff5d00/public" alt="Image" /><h4>How does it work?</h4><p>Realistic Simulations: Phisland offers a suite of realistic phishing simulations that mimic real-world attacks. By tracking user interactions with these simulations, Phisland enables organizations to identify vulnerabilities and opportunities for improvement in real-time.</p><p>Enhance Security Awareness: Phisland stands out with its ability to analyze and interpret user responses intelligently. Through advanced algorithms and customizable analytics, Phisland distils vast amounts of data into actionable intelligence, helping organizations create targeted and effective strategies to enhance their security awareness and resilience against cyber threats.</p><p>Embrace Phisland to proactively strengthen your cybersecurity measures and protect your organization from potential phishing attacks.</p><h3>Conclusion</h3><p>The recent ransomware attack on Indonesia's National Data Center underscores the escalating threat of ransomware and the profound impact such incidents can have on public services. The emergence of threats like Brain Cipher Ransomware further emphasizes the necessity for robust cybersecurity measures to guard against evolving cyber threats.</p><p>Organizations must remain vigilant, continually updating their security practices and staying informed about the latest threat intelligence to effectively combat ransomware attacks.</p><p>For comprehensive solutions to enhance your cybersecurity posture and protect against these threats, visit&nbsp;<a href="https://www.peris.ai/">Peris.ai Cybersecurity</a>. Explore our wide range of products and services designed to keep your organization secure in an ever-changing digital landscape. Don't wait—safeguard your digital assets with Peris.ai today!</p>

Internet service

Network / Network Equipment

System / Website / Application development

Peris.ai, a group of practitioners with professional experience in cybersecurity, revealed in more detail about the Cipher Brain ransomware that has attacked the Temporary National Data Center since last June 20.

Peris.ai Analysis: Brain Cipher Ransomware Attack on Indonesia’s National Data Center

Plug and Play, the world's largest global innovation platform that connects startups, corporations, and investors, has announced a strategic partnership with EDOTCO Group Sdn Bhd (EDOTCO), a leading provider of integrated telecommunications infrastructure services headquartered in&nbsp;Kuala Lumpur, Malaysia. The partnership aims to accelerate innovation and drive transformation within the telecommunications industry to address the industry's most pressing challenges and uncover new opportunities. EDOTCO will be joining Plug and Play's newly launched&nbsp;<a href="https://www.plugandplayapac.com/malaysia-program" rel="nofollow" target="_blank">accelerator program in&nbsp;Malaysia</a>&nbsp;which aims to spur the Malaysian startup ecosystem alongside other partners such as Khazanah Nasional, Celcomdigi, and Sime Darby Plantation.&nbsp;

"As the telecommunications industry continues to evolve, companies must stay ahead of the curve by embracing innovation and technology," said Jupe Tan, Managing Partner, Plug and Play APAC. "We are excited to join forces with EDOTCO to create a collaborative platform that brings together startups, corporations, and industry experts to bolster&nbsp;Malaysia's&nbsp;growing tech scene and drive innovations in connectivity and infrastructure in the country."

Through this partnership, startups working on groundbreaking technologies such as 5G infrastructure, IoT connectivity, network optimization, and sustainable solutions will have the opportunity to engage directly with EDOTCO's vast experience and resources. This collaboration will also enable EDOTCO to tap into Plug and Play's global ecosystem, gaining access to a diverse range of innovative solutions that can help drive operational excellence and enhance customer experiences.

"In today's rapidly evolving telecommunications landscape, staying at the forefront demands an unwavering commitment to innovation and technology. This partnership between Plug and Play and EDOTCO is a testament to our shared dedication to shaping the future of connectivity in&nbsp;Malaysia&nbsp;and across our eight other markets in&nbsp;Asia. Together, we'll forge an innovation bridge that unites&nbsp;Malaysia's&nbsp;thriving tech community, redefining how we connect and advancing equitable connectivity across the nation," said&nbsp;Adlan Tajudin, Group CEO, EDOTCO Group.

The partnership will involve various initiatives, including innovation workshops, dealflow meetings with startups, and networking events that facilitate meaningful interactions between startups, corporate partners, and EDOTCO's experts. These efforts will contribute to fostering a culture of innovation and entrepreneurship in the telecommunications ecosystem.&nbsp; 

Find out more about Plug and Play's initiatives in&nbsp;Malaysia:<a href="https://www.plugandplayapac.com/malaysia-program" rel="nofollow" target="_blank">https://www.plugandplayapac.com/malaysia-program</a>

<h1>Plug and Play announces Strategic Partnership with EDOTCO Group to Drive Innovation in the Telecommunications Industry</h1><p>Plug and Play, the world's largest global innovation platform that connects startups, corporations, and investors, has announced a strategic partnership with EDOTCO Group Sdn Bhd (EDOTCO), a leading provider of integrated telecommunications infrastructure services headquartered in&nbsp;Kuala Lumpur, Malaysia. The partnership aims to accelerate innovation and drive transformation within the telecommunications industry to address the industry's most pressing challenges and uncover new opportunities. EDOTCO will be joining Plug and Play's newly launched&nbsp;<a href="https://www.plugandplayapac.com/malaysia-program" rel="nofollow" target="_blank">accelerator program in&nbsp;Malaysia</a>&nbsp;which aims to spur the Malaysian startup ecosystem alongside other partners such as Khazanah Nasional, Celcomdigi, and Sime Darby Plantation.&nbsp;</p><p>"As the telecommunications industry continues to evolve, companies must stay ahead of the curve by embracing innovation and technology," said Jupe Tan, Managing Partner, Plug and Play APAC. "We are excited to join forces with EDOTCO to create a collaborative platform that brings together startups, corporations, and industry experts to bolster&nbsp;Malaysia's&nbsp;growing tech scene and drive innovations in connectivity and infrastructure in the country."</p><p>Through this partnership, startups working on groundbreaking technologies such as 5G infrastructure, IoT connectivity, network optimization, and sustainable solutions will have the opportunity to engage directly with EDOTCO's vast experience and resources. This collaboration will also enable EDOTCO to tap into Plug and Play's global ecosystem, gaining access to a diverse range of innovative solutions that can help drive operational excellence and enhance customer experiences.</p><p>"In today's rapidly evolving telecommunications landscape, staying at the forefront demands an unwavering commitment to innovation and technology. This partnership between Plug and Play and EDOTCO is a testament to our shared dedication to shaping the future of connectivity in&nbsp;Malaysia&nbsp;and across our eight other markets in&nbsp;Asia. Together, we'll forge an innovation bridge that unites&nbsp;Malaysia's&nbsp;thriving tech community, redefining how we connect and advancing equitable connectivity across the nation," said&nbsp;Adlan Tajudin, Group CEO, EDOTCO Group.</p><p>The partnership will involve various initiatives, including innovation workshops, dealflow meetings with startups, and networking events that facilitate meaningful interactions between startups, corporate partners, and EDOTCO's experts. These efforts will contribute to fostering a culture of innovation and entrepreneurship in the telecommunications ecosystem.&nbsp; </p><p>Find out more about Plug and Play's initiatives in&nbsp;Malaysia:<a href="https://www.plugandplayapac.com/malaysia-program" rel="nofollow" target="_blank">https://www.plugandplayapac.com/malaysia-program</a></p><p>Established in 2012, EDOTCO Group is the first regional and integrated telecommunications infrastructure services company in Asia, providing end-to-end solutions in the tower services sector from tower leasing, colocations, build-to-suit, energy, transmission and operations and maintenance (O&M).

EDOTCO Group operates and manages a regional portfolio of over 54,000 towers across Malaysia, Indonesia, Bangladesh, Cambodia, Sri Lanka, Pakistan, Philippines, Myanmar, and Laos. EDOTCO strives to deliver outstanding performance in telecommunications infrastructure services and solutions. Its state-of-the-art real-time monitoring service, echo, has driven significant improvements in field operations while maximising operational efficiencies in terms of battery, energy and fuel consumption for telecommunications infrastructure.</p><p>+6 03 2779 2699
edotco.communications@edotcogroup.com</p>