Indonesia Under Cyberattacks: Analyzing Threat Actors

Cyble Research analyzed a series of coordinated cybercrime activities targeting Indonesian entities in mid‑2021, including an alleged 200M+ PII data leak (claiming 279M records) sold on RaidForums and mass exploitation of vulnerable websites posted to GitHub and forums. Threat actors (aliases such as Kotz and AkuCintaMamaMuda and groups like RaidForum Indo Cyber/DragonForce Malaysia) used automated tools (e.g., SQLMap) to exfiltrate databases, shared tools/tutorials on Telegram, and conducted DDoS and breach campaigns impacting government, education, health, and commercial portals; the report includes impacted asset types, sample leaked data, TTP diagrams, and remediation recommendations.