Indonesia’s Gambling Ecosystem Exposed With Indicators of National-Level Cyber Operations

A security research investigation uncovered a massive, long-running Indonesian gambling cybercrime ecosystem (active since ~2011) controlling ~328,039 domains — including ~90k hacked domains and ~236k purchased domains — distributing thousands of malicious Android dropper apps (hosted on public S3) that silently install payloads and use Firebase for command/control, compromising government and enterprise subdomains via TLS-terminating reverse proxies, and exposing over 51,000 stolen credentials on dark web forums, indicating high sophistication, persistence, and active exploitation at scale.