Indonesia Faces a Broad Mix of Cyber Threats in 2026
Summary
The article surveys Indonesian cyber threats in 2026, including Android RATs, ClickFix and Coretax phishing, espionage, ransomware, DDoS and credential theft, and recommends stronger MFA, mobile and supply-chain security, and cross-sector coordination.
Key points
- The article describes SURXRAT V5 as an Android RAT that can intercept OTPs and enable financial fraud, ransomware-style locking, and AI-assisted evasion.
- ClickFix campaigns reportedly use compromised sites and Indonesian-language lures to deliver MIMICRAT, steal tokens, and maintain access.
- A Coretax phishing campaign attributed to GoldFactory reportedly used WhatsApp impersonation and malicious APKs to intercept OTPs and take over banking accounts.
- The article summarizes espionage activity attributed to groups including Lotus Blossom, Fancy Bear, Amaranth-Dragon, and Shadow Campaigns; it cites exploitation of CVE-2025-8088 among the reported activity.
- It describes The Gentlemen ransomware operations as a threat to organizations in sectors including government, healthcare, telecom, and manufacturing.
- The article reports that AISURU/Kimwolf DDoS traffic reached 31.4 Tbps and says Indonesia is both a target and a source of infected Android devices.
- An alleged sale of 3 million customer records from an unnamed Indonesian bank is presented as a financial-sector risk; the article also describes credential-based access to satellite-sector data.
Article Details
- Event Type
- A 2026 overview of cyber threats and campaigns targeting Indonesia, including financial scams, mobile malware, phishing, espionage, ransomware, DDoS, and credential theft.
- Impact
- The article describes risks to government, banking, telecommunications, and critical infrastructure, including OTP interception and remote banking takeovers, persistent access and data theft, ransomware-related service disruption, and DDoS impacts. It reports significant financial losses from the Coretax-related campaign and characterizes the alleged sale of 3 million Indonesian bank customer records as a breach risk; the sale is presented as alleged.
MITRE ATT&CK
T1059.001 · PowerShellThe ClickFix campaign reportedly tricked victims into executing malicious PowerShell commands.T1195.002 · Compromise Software Supply ChainLotus Blossom reportedly abused software supply chains, including Notepad++ updates, to infiltrate networks.T1486 · Data Encrypted for ImpactThe article says ransomware groups encrypt Windows, Linux, and ESXi systems.T1498.001 · Direct Network FloodThe AISURU/Kimwolf botnet reportedly launched large-scale DDoS floods.T1566 · PhishingThe article reports phishing campaigns, including impersonation of Indonesian tax officers via WhatsApp.
CVE
Threat Actors
Amaranth-DragonThe article reports that Amaranth-Dragon weaponized CVE-2025-8088 using fake civil servant salary decree files to infect Indonesian government agencies.APT28The article identifies APT28 as an alternate name for Fancy Bear and attributes the same reported targeting and activity to that group.Fancy BearThe article says Fancy Bear targeted government, defense, and energy sectors through spear-phishing and rapid exploitation of Microsoft Office vulnerabilities; it identifies APT28 as an alternate name.GoldFactoryThe article attributes the Coretax-related phishing and mobile malware campaign, including OTP interception and remote banking takeovers, to GoldFactory.Lotus BlossomThe article reports that Lotus Blossom conducted long-term espionage in Southeast Asia and abused supply chains, including Notepad++ updates, to infiltrate government and telecom networks.TGR-STA-1030The article names TGR-STA-1030 in connection with the Shadow Campaigns, which reportedly compromised an Indonesian airline and government-linked entities.The GentlemenThe article identifies The Gentlemen as a ransomware group operating a double-extortion RaaS model and targeting systems in multiple sectors.UNC6619The article names UNC6619 in connection with the Shadow Campaigns, which reportedly compromised an Indonesian airline and government-linked entities.
Malware
Aisuru/KimwolfRansomware escalation and large-scale threats from groups like The Gentlemen, Lotus Blossom, Fancy Bear, Amaranth-Dragon, Shadow Campaigns, and AISURU/Kimwolf threaten national security and critical services.ArsinkRATThe malware-as-a-service Android RAT SURXRAT V5, derived from ArsinkRAT, has been linked to Indonesian threat actors. By abusing gaming apps and Android Accessibility Services, it enables OTP interception, financialMIMICRAT#SURXRATSURXRAT V5SURXRAT V5 Android RAT demonstrates malware-as-a-service capabilities, intercepting OTPs and enabling financial fraud with AI-assisted evasion.
Vendors
MicrosoftFancy Bear (APT28) targeted government, defense, and energy sectors through spear-phishing and rapid exploitation of Microsoft Office vulnerabilities.xAIIndonesia also faces emerging risks from AI misuse, including deepfake abuse linked to tools developed by xAI. Combined with ransomware, identity-based attacks, and supply-chain compromises, cyber incidents now have a
Products
AndroidSURXRAT V5 Android RAT demonstrates malware-as-a-service capabilities, intercepting OTPs and enabling financial fraud with AI-assisted evasion.CoreTax#SURXRATESXiRaaS models, exploiting exposed VPNs and Active Directory weaknesses to encrypt Windows, Linux, and ESXi systems. Government, BFSI, healthcare, telecom, and manufacturing sectors face operational shutdowns andLinuxShadow Campaigns by TGR-STA-1030/UNC6619 compromised an Indonesian airline and government-linked entities using Exchange exploits, Cobalt Strike, and Linux rootkits.Microsoft Active DirectoryGroups such as The Gentlemen operate double-extortion RaaS models, exploiting exposed VPNs and Active Directory weaknesses to encrypt Windows, Linux, and ESXi systems. Government, BFSI, healthcare, telecom, andMicrosoft Exchange ServerShadow Campaigns by TGR-STA-1030/UNC6619 compromised an Indonesian airline and government-linked entities using Exchange exploits, Cobalt Strike, and Linux rootkits.Microsoft OfficeFancy Bear (APT28) targeted government, defense, and energy sectors through spear-phishing and rapid exploitation of Microsoft Office vulnerabilities.Microsoft Windowsoperate double-extortion RaaS models, exploiting exposed VPNs and Active Directory weaknesses to encrypt Windows, Linux, and ESXi systems. Government, BFSI, healthcare, telecom, and manufacturing sectors faceNotepad++Lotus Blossom conducted long-term espionage across Southeast Asia, abusing supply chains such as Notepad++ updates to infiltrate government and telecom networks.WhatsAppCoretax phishing campaigns impersonate tax officers via WhatsApp, distributing malicious APKs and intercepting OTPs to achieve remote banking takeovers.WinRARAmaranth-Dragon weaponized the WinRAR vulnerability CVE-2025-8088 using fake civil servant salary decree files to infect Indonesian government agencies.
Tools
Countries
Industries
BankingIndonesia faces an increasingly complex cyber threat landscape in 2026, with scams, mobile malware, state-sponsored espionage, and ransomware targeting government, banking, telecom, and critical infrastructure.Critical infrastructureIndonesia faces an increasingly complex cyber threat landscape in 2026, with scams, mobile malware, state-sponsored espionage, and ransomware targeting government, banking, telecom, and critical infrastructure.DefenseFancy Bear (APT28) targeted government, defense, and energy sectors through spear-phishing and rapid exploitation of Microsoft Office vulnerabilities.EnergyFancy Bear (APT28) targeted government, defense, and energy sectors through spear-phishing and rapid exploitation of Microsoft Office vulnerabilities.GovernmentIndonesia faces an increasingly complex cyber threat landscape in 2026, with scams, mobile malware, state-sponsored espionage, and ransomware targeting government, banking, telecom, and critical infrastructure.HealthcareVPNs and Active Directory weaknesses to encrypt Windows, Linux, and ESXi systems. Government, BFSI, healthcare, telecom, and manufacturing sectors face operational shutdowns and data leak threats.Manufacturingweaknesses to encrypt Windows, Linux, and ESXi systems. Government, BFSI, healthcare, telecom, and manufacturing sectors face operational shutdowns and data leak threats.Satellite and aerospaceleveraged stolen credentials and weak multi-factor authentication controls to access sensitive satellite and aerospace project data, posing espionage and national security risks.