Threats Tagged 'indonesia'

A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services.

MediumMalwareIndonesiaPeruPhilippines+2#goldfactory#gigabud.rat#mmrat

A malicious campaign is targeting French-speaking users in an attempt to steal passwords, payment details and banking details from people across France, according to researchers at the Institute for Strategic Studies (ISS).

This comprehensive analysis covers cyber threats and security issues in the financial industry, both in Korea and globally. It examines malware and phishing cases, lists top malware strains, and provides statistics on leaked Korean accounts. Key issues on the deep and dark web are highlighted, including a major database leak from Indonesia's largest bank, exposing sensitive financial data of approximately 3 million customers. A ransomware attack on a leading African financial services company by INC Ransom group is also detailed, with 100GB of data reportedly stolen. The report emphasizes the potential for widespread damage and chain attacks, urging proactive measures among financial institutions and related companies.

MediumCampaignGermanyUnited KingdomFrance+7#inc ransom#financial sector#cyber threats

A sophisticated malware campaign is increasingly targeting WordPress websites to inject online casino spam content. This malware uses multiple redundancy and reinfection techniques, storing payloads in databases and non-standard file extensions to evade detection and maintain persistence. The campaign exploits the popularity of online gambling and leverages the decline of other spam sources, such as essay writing services, to focus on lucrative casino spam. Although primarily noted in Indonesia due to strict gambling laws, the campaign has international reach. The malware's complexity and persistence mechanisms pose risks to website integrity, SEO rankings, and user trust. European organizations running WordPress sites could be targeted, especially those with lax security or outdated plugins. Mitigation requires advanced detection, continuous monitoring, and tailored cleanup strategies. The threat is assessed as medium severity due to its impact on website integrity and SEO rather than direct data breach or system compromise.

MediumCampaignGermanyFranceNetherlands+5#gambling#spam#malware

A sophisticated mobile malware campaign is targeting Indonesian pensioners by impersonating TASPEN, the state pension fund. The attackers use a phishing website to distribute a malicious Android app that steals banking credentials, intercepts SMS messages for OTPs, and captures biometric data. The malware employs advanced evasion techniques and communicates with a command and control server, likely operated by a Chinese-speaking threat actor. This campaign poses significant risks to Indonesia's digital transformation efforts and public trust in government institutions. The successful targeting of TASPEN creates a dangerous precedent for attacks on other critical financial entities across Southeast Asia.