Ransomware Group Behind Major Indonesian Attack Wears Many Masks

Brain Cipher, a ransomware operation that disrupted Indonesia's national data center and impacted services across 200+ government agencies, appears to be one identity among several overlapping groups (including Reborn, EstateRansomware, and SenSayQ). The group uses leaked builders (LockBit 3.0) and variants (Babuk), runs standard ransomware infrastructure (victim portals, leak sites), demonstrates poor OPSEC with shared artifacts across aliases, and often does not exfiltrate or publish stolen data despite ransom demands.