Brain Cipher group downs Indonesian government data centre with Lockbit 3.0 ransomware

One of Indonesia’s government-owned national data centres suffered a significant ransomware attack that involved threat actors encrypting government data, disrupting immigration checks at airports and multiple public services.

 

In a recent statement, the Ministry of Communication and Information (Kominfo) of Indonesia said that on June 20, the Temporary National Data Center (PDNS) server started experiencing network problems. This caused operational disruptions in several public services including immigration services.

 

Indonesia’s cyber security agency, National Cyber and Crypto Agency (BSSN), confirmed that the disruptions were a result of a ransomware attack on PDNS servers.

 

Head of BSSN Hinsa Siburian said that the agency is working with Kominfo to investigate the incident and recover the affected systems.

 

In a statement shared with the media, Siburian said, “The results of our identification are the problems that occurred at the Temporary National Data Centre due to ransomware type cyber attacks.”

 

Between June 17 -20, threat actors deactivated Windows Defender security at the data centre and deleted file storage applications before planting the ransomware.

 

Siburian added that BSSN was able to confirm that a group of threat actors, going by the name Brain Cipher Ransomware, used a variant of the Lockbit 3.0 ransomware and infiltrated PDNS servers.

 

“This is important for lessons learned and mitigation efforts so that similar incidents do not happen again," said Siburian.

 

“BSSN Kominfo, Cyber Crime Polri, and KSO Telkom-Sigma-Lintasarta are still continuing to carry out thorough investigations referring to the forensic evidence that has been obtained. With all the limitations of evidence, or digital evidence due to the condition of the evidence being encrypted due to the ransomware attack," he added.

 

On June 24, authorities restored the affected Immigration Services, including Visa and Stay Permit Services, Immigration Checkpoint Services (TPI), Passport Services, Visa on Arrival (VOA) on boarding Services, and Immigration Document Management Services. 

 

BSSN said operations at as many as 282 other ministries, agencies and departments are being restored at present using a backup data centre.