Recently, a shocking incident occurred that resulted in the disruption of immigration services and various other public services. The disruption stemmed from a cyberattack carried out by Brain Cipher Ransomware.

The&nbsp;Pusat Data Nasional (PDN)&nbsp;was the main target of this attack since June 20. The cyberattack has crippled essential services like immigration services, leading to another impact on 210 instantiations. Although some services have been restored, the impact is still felt.

The&nbsp;Badan Siber dan Sandi Negara (BSSN)&nbsp;and related institutions immediately responded to this incident. Emergency measures were taken by sending an assistance team to the data center in Surabaya. The PDNS was built as an alternative because the main&nbsp;Pusat Data Nasional (PDN)&nbsp;is not yet completed.

The responsible party for this attack demanded a ransom of USD 8 million (approximately Rp 131 billion) to restore access to the system.

For context, PDN is managed by Telkom Group through Telkom Sigma. Telkom Indonesia’s Network &amp; IT Solution Director, Herlan Wijanarko, confirmed the ransom demand. However, the compensation process is still under evaluation.

In parallel with the recent events, the Brain Cipher Ransomware is an emerging threat actor currently focusing on organizational targets. The following analysis details the methods, indicators of compromise (IOCs), and tactics used by this ransomware group.

Brain Cipher Ransomware is delivered primarily through phishing campaigns. These campaigns often use deceptive emails to trick recipients into downloading and executing malicious files.

SHA1: 935c0b39837319fda571aa800b67d997b79c3198

- SHA256: eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

- SSDEEP: 3072/5qUpfDT6zT73Ew8Ym9wV9JyknP7SAy

- IP Addresses: 199.232.214.172 (US), 224.0.0.252

- Web: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

- VirusTotal:<a href="https://www.virustotal.com/gui/file/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12">VirusTotal Link</a>

- T1204.002: User Execution Malicious File

- T1555.003: Credentials from Web Browsers

The Brain Cipher Ransomware employs sophisticated techniques to infiltrate, propagate, and encrypt data within targeted networks. Its primary delivery method is through phishing emails, which often contain malicious attachments or links leading to malware downloads.

Once inside a network, the ransomware utilizes various tactics to escalate privileges, evade defenses, and gain access to sensitive information. For instance, it uses Windows Command Shell for execution and bypasses user account control for privilege escalation.

The ransomware's discovery tactics include querying the registry, discovering system information, and software discovery. These actions allow the ransomware to map out the infected environment and identify high-value targets for encryption.

Credential access is a significant aspect of Brain Cipher's methodology. It steals web session cookies, credentials from web browsers, and credentials stored in files, providing the attackers with the necessary information to further infiltrate the network or exfiltrate data.

Finally, the ransomware's impact tactic is data encryption, which renders the victim's data inaccessible until a ransom is paid. This tactic is effective in causing significant disruption to organizational operations, as seen in the recent attack on Indonesia's National Data Center.

To mitigate the threat posed by Brain Cipher Ransomware and similar attacks, organizations should adopt a multi-layered security approach. This includes:

- Email Security: Implementing robust email security solutions to detect and block phishing attempts.

- User Training: Regularly training employees to recognize and report phishing emails.

- Endpoint Security: Deploying advanced endpoint protection to detect and prevent malware execution.

- Network Segmentation: Segregating critical systems and data to limit the spread of ransomware.

- Backup Solutions: Maintaining regular backups of critical data and ensuring that backups are stored securely and offline.

- Incident Response Planning: Developing and regularly updating incident response plans to ensure a swift and effective response to ransomware attacks.

Enhancing Your Cybersecurity with Peris.ai

As cyber threats continue to evolve, it becomes increasingly important for organizations to stay ahead of potential attacks. Peris.ai offers advanced cybersecurity solutions designed to anticipate and defend against such threats. One such measure is&nbsp;<a href="https://www.peris.ai/product-services/ganesha/phisland">Peris.ai's Phisland</a>, a sophisticated phishing simulator designed to safeguard your digital frontier.

Phisland is a comprehensive phishing simulator that provides your organization with the tools to stay ahead of cyber threats. By simulating phishing attacks via email, websites, and WhatsApp, Phisland helps enhance your team's security awareness and overall cybersecurity posture.

Realistic Simulations: Phisland offers a suite of realistic phishing simulations that mimic real-world attacks. By tracking user interactions with these simulations, Phisland enables organizations to identify vulnerabilities and opportunities for improvement in real-time.

Enhance Security Awareness: Phisland stands out with its ability to analyze and interpret user responses intelligently. Through advanced algorithms and customizable analytics, Phisland distils vast amounts of data into actionable intelligence, helping organizations create targeted and effective strategies to enhance their security awareness and resilience against cyber threats.

Embrace Phisland to proactively strengthen your cybersecurity measures and protect your organization from potential phishing attacks.

The recent ransomware attack on Indonesia's National Data Center underscores the escalating threat of ransomware and the profound impact such incidents can have on public services. The emergence of threats like Brain Cipher Ransomware further emphasizes the necessity for robust cybersecurity measures to guard against evolving cyber threats.

Organizations must remain vigilant, continually updating their security practices and staying informed about the latest threat intelligence to effectively combat ransomware attacks.

For comprehensive solutions to enhance your cybersecurity posture and protect against these threats, visit&nbsp;<a href="https://www.peris.ai/">Peris.ai Cybersecurity</a>. Explore our wide range of products and services designed to keep your organization secure in an ever-changing digital landscape. Don't wait—safeguard your digital assets with Peris.ai today!

<p>Peris.ai, a group of practitioners with professional experience in cybersecurity, revealed in more detail about the Cipher Brain ransomware that has attacked the Temporary National Data Center since last June 20.</p> <img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/d85ec879-771a-45dc-6967-256db8309100/public" alt="Image" /><p>Recently, a shocking incident occurred that resulted in the disruption of immigration services and various other public services. The disruption stemmed from a cyberattack carried out by Brain Cipher Ransomware.</p><p>The&nbsp;Pusat Data Nasional (PDN)&nbsp;was the main target of this attack since June 20. The cyberattack has crippled essential services like immigration services, leading to another impact on 210 instantiations. Although some services have been restored, the impact is still felt.</p><p>The&nbsp;Badan Siber dan Sandi Negara (BSSN)&nbsp;and related institutions immediately responded to this incident. Emergency measures were taken by sending an assistance team to the data center in Surabaya. The PDNS was built as an alternative because the main&nbsp;Pusat Data Nasional (PDN)&nbsp;is not yet completed.</p><p>The responsible party for this attack demanded a ransom of USD 8 million (approximately Rp 131 billion) to restore access to the system.</p><p>For context, PDN is managed by Telkom Group through Telkom Sigma. Telkom Indonesia’s Network &amp; IT Solution Director, Herlan Wijanarko, confirmed the ransom demand. However, the compensation process is still under evaluation.</p><h2>Brain Cipher Ransomware: An Overview</h2><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/3a827b1b-c7e0-4f6c-c3b5-10875c2c1a00/public" alt="Image" /><p>In parallel with the recent events, the Brain Cipher Ransomware is an emerging threat actor currently focusing on organizational targets. The following analysis details the methods, indicators of compromise (IOCs), and tactics used by this ransomware group.</p><h3>Method of Delivery: Phishing</h3><p>Brain Cipher Ransomware is delivered primarily through phishing campaigns. These campaigns often use deceptive emails to trick recipients into downloading and executing malicious files.</p><h3>Indicators of Compromise (IOCs)</h3><p>- MD5: 448f1796fe8de02194b21c0715e0a5f6</p><p>SHA1: 935c0b39837319fda571aa800b67d997b79c3198</p><p>- SHA256: eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12</p><p>- SSDEEP: 3072/5qUpfDT6zT73Ew8Ym9wV9JyknP7SAy</p><p>- IP Addresses: 199.232.214.172 (US), 224.0.0.252</p><p>- Web: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion</p><p>- Email: brain.support@cyberfear.com</p><p>- VirusTotal:<a href="https://www.virustotal.com/gui/file/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12">VirusTotal Link</a></p><h3>MITRE ATT&amp;CK&nbsp;</h3><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/c8aabfb4-658a-4693-ab70-24c72fede100/public" alt="Image" /><h4>Execution</h4><p>- T1059.003: Windows Command Shell</p><p>- T1204.002: User Execution Malicious File</p><h4>Privilege Escalation</h4><p>- T1548.002: Bypass User Account Control</p><h4>Defense Evasion</h4><p>- T1548.002: Bypass User Account Control</p><h4>Credential Access</h4><p>- T1539: Steal Web Session Cookies</p><p>- T1555.003: Credentials from Web Browsers</p><p>- T1552.001: Credentials in Files</p><h4>Discovery</h4><p>- T1012: Query Registry</p><p>- T1082: System Information Discovery</p><p>- T1518: Software Discovery</p><h4>Impact</h4><p>- T1486: Data Encryption for Impact</p><h3>Detailed Analysis</h3><p>The Brain Cipher Ransomware employs sophisticated techniques to infiltrate, propagate, and encrypt data within targeted networks. Its primary delivery method is through phishing emails, which often contain malicious attachments or links leading to malware downloads.</p><p>Once inside a network, the ransomware utilizes various tactics to escalate privileges, evade defenses, and gain access to sensitive information. For instance, it uses Windows Command Shell for execution and bypasses user account control for privilege escalation.</p><p>The ransomware's discovery tactics include querying the registry, discovering system information, and software discovery. These actions allow the ransomware to map out the infected environment and identify high-value targets for encryption.</p><p>Credential access is a significant aspect of Brain Cipher's methodology. It steals web session cookies, credentials from web browsers, and credentials stored in files, providing the attackers with the necessary information to further infiltrate the network or exfiltrate data.</p><p>Finally, the ransomware's impact tactic is data encryption, which renders the victim's data inaccessible until a ransom is paid. This tactic is effective in causing significant disruption to organizational operations, as seen in the recent attack on Indonesia's National Data Center.</p><h3>Mitigation and Response</h3><p>To mitigate the threat posed by Brain Cipher Ransomware and similar attacks, organizations should adopt a multi-layered security approach. This includes:</p><p>- Email Security: Implementing robust email security solutions to detect and block phishing attempts.</p><p>- User Training: Regularly training employees to recognize and report phishing emails.</p><p>- Endpoint Security: Deploying advanced endpoint protection to detect and prevent malware execution.</p><p>- Network Segmentation: Segregating critical systems and data to limit the spread of ransomware.</p><p>- Backup Solutions: Maintaining regular backups of critical data and ensuring that backups are stored securely and offline.</p><p>- Incident Response Planning: Developing and regularly updating incident response plans to ensure a swift and effective response to ransomware attacks.</p><h3>Enhancing Your Cybersecurity with Peris.ai</h3><p>As cyber threats continue to evolve, it becomes increasingly important for organizations to stay ahead of potential attacks. Peris.ai offers advanced cybersecurity solutions designed to anticipate and defend against such threats. One such measure is&nbsp;<a href="https://www.peris.ai/product-services/ganesha/phisland">Peris.ai's Phisland</a>, a sophisticated phishing simulator designed to safeguard your digital frontier.</p><h4>What is Ganesha - Phisland?</h4><p>Phisland is a comprehensive phishing simulator that provides your organization with the tools to stay ahead of cyber threats. By simulating phishing attacks via email, websites, and WhatsApp, Phisland helps enhance your team's security awareness and overall cybersecurity posture.</p><img style="width: 100%;" src="https://imagedelivery.net/H6_s_Eb_ylTWnSEV3HlmYQ/b75c142d-04ba-4a39-58bd-b66b60ff5d00/public" alt="Image" /><h4>How does it work?</h4><p>Realistic Simulations: Phisland offers a suite of realistic phishing simulations that mimic real-world attacks. By tracking user interactions with these simulations, Phisland enables organizations to identify vulnerabilities and opportunities for improvement in real-time.</p><p>Enhance Security Awareness: Phisland stands out with its ability to analyze and interpret user responses intelligently. Through advanced algorithms and customizable analytics, Phisland distils vast amounts of data into actionable intelligence, helping organizations create targeted and effective strategies to enhance their security awareness and resilience against cyber threats.</p><p>Embrace Phisland to proactively strengthen your cybersecurity measures and protect your organization from potential phishing attacks.</p><h3>Conclusion</h3><p>The recent ransomware attack on Indonesia's National Data Center underscores the escalating threat of ransomware and the profound impact such incidents can have on public services. The emergence of threats like Brain Cipher Ransomware further emphasizes the necessity for robust cybersecurity measures to guard against evolving cyber threats.</p><p>Organizations must remain vigilant, continually updating their security practices and staying informed about the latest threat intelligence to effectively combat ransomware attacks.</p><p>For comprehensive solutions to enhance your cybersecurity posture and protect against these threats, visit&nbsp;<a href="https://www.peris.ai/">Peris.ai Cybersecurity</a>. Explore our wide range of products and services designed to keep your organization secure in an ever-changing digital landscape. Don't wait—safeguard your digital assets with Peris.ai today!</p>

Internet service

Network / Network Equipment

System / Website / Application development

Peris.ai, a group of practitioners with professional experience in cybersecurity, revealed in more detail about the Cipher Brain ransomware that has attacked the Temporary National Data Center since last June 20.

Peris.ai Analysis: Brain Cipher Ransomware Attack on Indonesia’s National Data Center

HR / Recruitment

Skin care / Cosmetics / Hair products

Film / Drama

Magazines / Books / Publications

Marketing / Research

Diet / Health food / Supplement

Childbirth / Childcare

Interior / Furniture / Storage

Mobile device

Servers / Peripherals

Electronic components / Semiconductors / Electrical equipment

Department stores / Supermarkets / Convenience stores / Stores

Wholeseller

Manga / Anime

Arcade Game

Toys / Playsets / Dolls

Car / Car Supplies

Motorcycles / Motorcycle Supplies

Daily necessities / Household goods

Garden / DIY

Shoes / Bags

Jewelry / Accessories

Kids / Baby / Maternity

Food / Sweets

Soft Drinks / Alcoholic drinks

Restaurant / Fast food / Streetfood

Eating at home / Delivery

Fitness / Healthcare

Medical / Hospital

Pharmaceuticals

Pets / Pet Supplies

Gifts / Flowers

Love / Marriage

Funeral

Hotels / inns

Travel / Sightseeing

Theme Park / Amusement park

Residential / Condominium

Commercial facilities / Office buildings

Architecture / Space design

Construction / Civil engineering

Advertising / Promotion / PR

Sales

Management Consulting

Think tank

Legal / Patent / Intellectual Property

Logistics / Warehouse / Cargo

Steel / Metal / Glass / Earth / Stone / Rubber

Chemistry

Electricity / Gas / Resources / Energy

Nature / Weather

School / University

Cram school / Preparatory school / Online education

Life insurance / Non-life insurance

Mobile app

Mobile games

Cooking / Home appliances

Health and Beauty appliances

Application

Ladies' Fashion

Men's Fashion

Accounting

Environment / SGDs / Recycling

International activity

Full time job / Part-time job / Career

E-commerce

Music

Internet Service Provider / Line connection

Camera

AV equipment

Consumer Games

Outdoors / Mountain Climbing

Welfare / Nursing / Rehabilitation

Qualifications / Study Abroad / Language

Childcare / Early childhood education

Banks / Credit unions

Credit card / Loan

Securities / FX / Investment Trusts

Moving

Politics / Government / Local government

Volunteer

Agriculture / Forestry / Fisheries

Bicycle / Bicycle Supplies

Female Related

Venture Capitals

Coaching / Mentoring / Consultation

Automotive / Motorcycle / Bicycle

Automotive / Automotive Supplies

Interior / Goods

Real Estate / Architecture / Construction

Software

Blockchain / Web3

Security

Telecommunications / VoIP

Show Business

Comedy

Startups

Technology

Peris.ai is a cybersecurity startup that protects businesses and organizations from online threats. Our team of experienced security professionals is dedicated to providing innovative and practical solutions to help keep our clients safe in the constantly evolving world of cyber threats.

We offer various services, including cybersecurity as a service, security operation centers, penetration testing, security assessments, incident response, and customized security consulting and training. Our cutting-edge technology and approach to security help our clients stay ahead of the curve and protected.

Join us in the fight against cyber threats and join our team as we strive to make the internet safer for all.

You build, we guard.

Peris.ai - Cybersecurity