Peris.ai Analysis: Brain Cipher Ransomware Attack on Indonesia’s National Data Center

by Ferry Bayu | Jun 26, 2024 | Business

Peris.ai, a group of practitioners with professional experience in cybersecurity, revealed in more detail about the Cipher Brain ransomware that has attacked the Temporary National Data Center since last June 20.

Recently, a shocking incident occurred that resulted in the disruption of immigration services and various other public services. The disruption stemmed from a cyberattack carried out by Brain Cipher Ransomware.

The Pusat Data Nasional (PDN) was the main target of this attack since June 20. The cyberattack has crippled essential services like immigration services, leading to another impact on 210 instantiations. Although some services have been restored, the impact is still felt.

The Badan Siber dan Sandi Negara (BSSN) and related institutions immediately responded to this incident. Emergency measures were taken by sending an assistance team to the data center in Surabaya. The PDNS was built as an alternative because the main Pusat Data Nasional (PDN) is not yet completed.

The responsible party for this attack demanded a ransom of USD 8 million (approximately Rp 131 billion) to restore access to the system.

For context, PDN is managed by Telkom Group through Telkom Sigma. Telkom Indonesia’s Network & IT Solution Director, Herlan Wijanarko, confirmed the ransom demand. However, the compensation process is still under evaluation.

Brain Cipher Ransomware: An Overview

In parallel with the recent events, the Brain Cipher Ransomware is an emerging threat actor currently focusing on organizational targets. The following analysis details the methods, indicators of compromise (IOCs), and tactics used by this ransomware group.

Method of Delivery: Phishing

Brain Cipher Ransomware is delivered primarily through phishing campaigns. These campaigns often use deceptive emails to trick recipients into downloading and executing malicious files.

Indicators of Compromise (IOCs)

• MD5: 448f1796fe8de02194b21c0715e0a5f6

SHA1: 935c0b39837319fda571aa800b67d997b79c3198

• SHA256: eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

• SSDEEP: 3072/5qUpfDT6zT73Ew8Ym9wV9JyknP7SAy

IP Addresses: 199.232.214.172 (US), 224.0.0.252

Web: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Email: br***********@*******ar.com

VirusTotal:VirusTotal Link

MITRE ATT&CK 

Execution

• T1059.003: Windows Command Shell

• T1204.002: User Execution Malicious File

Privilege Escalation

• T1548.002: Bypass User Account Control

Defense Evasion

• T1548.002: Bypass User Account Control

Credential Access

• T1539: Steal Web Session Cookies

• T1555.003: Credentials from Web Browsers

• T1552.001: Credentials in Files

Discovery

• T1012: Query Registry

• T1082: System Information Discovery

• T1518: Software Discovery

Impact

• T1486: Data Encryption for Impact

Detailed Analysis

The Brain Cipher Ransomware employs sophisticated techniques to infiltrate, propagate, and encrypt data within targeted networks. Its primary delivery method is through phishing emails, which often contain malicious attachments or links leading to malware downloads.

Once inside a network, the ransomware utilizes various tactics to escalate privileges, evade defenses, and gain access to sensitive information. For instance, it uses Windows Command Shell for execution and bypasses user account control for privilege escalation.

The ransomware’s discovery tactics include querying the registry, discovering system information, and software discovery. These actions allow the ransomware to map out the infected environment and identify high-value targets for encryption.

Credential access is a significant aspect of Brain Cipher’s methodology. It steals web session cookies, credentials from web browsers, and credentials stored in files, providing the attackers with the necessary information to further infiltrate the network or exfiltrate data.

Finally, the ransomware’s impact tactic is data encryption, which renders the victim’s data inaccessible until a ransom is paid. This tactic is effective in causing significant disruption to organizational operations, as seen in the recent attack on Indonesia’s National Data Center.

Mitigation and Response

To mitigate the threat posed by Brain Cipher Ransomware and similar attacks, organizations should adopt a multi-layered security approach. This includes:

• Email Security: Implementing robust email security solutions to detect and block phishing attempts.

• User Training: Regularly training employees to recognize and report phishing emails.

• Endpoint Security: Deploying advanced endpoint protection to detect and prevent malware execution.

• Network Segmentation: Segregating critical systems and data to limit the spread of ransomware.

• Backup Solutions: Maintaining regular backups of critical data and ensuring that backups are stored securely and offline.

• Incident Response Planning: Developing and regularly updating incident response plans to ensure a swift and effective response to ransomware attacks.

Enhancing Your Cybersecurity with Peris.ai

As cyber threats continue to evolve, it becomes increasingly important for organizations to stay ahead of potential attacks. Peris.ai offers advanced cybersecurity solutions designed to anticipate and defend against such threats. One such measure is Peris.ai’s Phisland, a sophisticated phishing simulator designed to safeguard your digital frontier.

What is Ganesha – Phisland?

Phisland is a comprehensive phishing simulator that provides your organization with the tools to stay ahead of cyber threats. By simulating phishing attacks via email, websites, and WhatsApp, Phisland helps enhance your team’s security awareness and overall cybersecurity posture.

How does it work?

Realistic Simulations: Phisland offers a suite of realistic phishing simulations that mimic real-world attacks. By tracking user interactions with these simulations, Phisland enables organizations to identify vulnerabilities and opportunities for improvement in real-time.

Enhance Security Awareness: Phisland stands out with its ability to analyze and interpret user responses intelligently. Through advanced algorithms and customizable analytics, Phisland distills vast amounts of data into actionable intelligence, helping organizations create targeted and effective strategies to enhance their security awareness and resilience against cyber threats.

Embrace Phisland to proactively strengthen your cybersecurity measures and protect your organization from potential phishing attacks.

Conclusion

The recent ransomware attack on Indonesia’s National Data Center underscores the escalating threat of ransomware and the profound impact such incidents can have on public services. The emergence of threats like Brain Cipher Ransomware further emphasizes the necessity for robust cybersecurity measures to guard against evolving cyber threats.

Organizations must remain vigilant, continually updating their security practices and staying informed about the latest threat intelligence to effectively combat ransomware attacks.

For comprehensive solutions to enhance your cybersecurity posture and protect against these threats, visitPeris.ai Cybersecurity. Explore our wide range of products and services designed to keep your organization secure in an ever-changing digital landscape. Don’t wait—safeguard your digital assets with Peris.ai today!

Tanabe Consulting Reveals: Approximately 80% of Japanese Companies Expanding or Intending to Expand Overseas Operations

by Ferry Bayu | Jun 26, 2024 | Business

• ASEAN is the most targeted region for expansion; nearly half expect “increased revenue and profit” in overseas business over the next three years
• Results of the “corporate survey on overseas business by Japanese companies” released

Tanabe Consulting Co., Ltd., a leading management consulting firm in Japan (Head office: Chiyoda-ku, Tokyo, and Yodogawa-ku, Osaka; President: Takahiko Wakamatsu, hereafter Tanabe Consulting), announces the results of the “Corporate Survey on Overseas Businesses.” This survey was conducted among corporate managers, executives, senior management, and those in charge of corporate planning departments throughout Japan. The survey results are as follows.

High Interest in Overseas Expansion: Approximately 80% of Japanese companies responded positively that they are either currently developing overseas business or would like to do so in the future. This indicates a strong interest in ongoing or future overseas business development.

Popular Regions for Expansion: ASEAN accounted for the largest number of countries and regions where Japanese companies are considering or expanding their overseas operations, making up approximately half of the total. About 40% of respondents cited “market growth potential and future prospects” as the reason for selecting a particular country or region for expansion.

Positive Business Outlook: About half of the Japanese companies expect their overseas businesses to see “increased sales and profits” over the next three years. Specifically, 49.4% of companies anticipate increased sales and profits, while only 3.1% foresee a decrease. This suggests that overseas business is currently the mainstay of growth for Japanese companies.

Importance of Market Potential: More than 40% of the respondents place importance on “market growth potential and future prospects” when entering or expanding their overseas business. The most common reason for selecting countries and regions for expansion was “market growth potential/future prospects” at 41.8%, highlighting the importance of promising markets in decision-making.

These findings highlight the growing focus and optimism of Japanese companies regarding international markets, particularly in the ASEAN region, and their expectations of positive business outcomes in the near future.

Insights from Tanabe Consulting’s expert consultants

About half of the companies engaged in overseas business anticipate “revenue and profit growth” over the next three years and have prioritized the development of new markets. However, securing and training global and specialized human resources, essential for business promotion, remains a significant challenge regardless of industry or company size.

According to the Bank of Japan’s “Short-Term Economic Survey of Enterprises in Japan” released in December 2023, approximately 70% of all Japanese companies reported a “not so good” outlook. In contrast, about half of the companies in our survey view their overseas business prospects as favorable over the next three years, with only 3.1% expecting a decline in sales and profits. This indicates that overseas business can be a catalyst for further growth in Japanese companies.

Report Author

Director, Tanabe Consulting Co., Ltd

Strategy & Domain Consulting Division and Global Consulting　 Koichi Murakami

Tanabe Consulting Co., Ltd

Global Consulting Chief Yuma Kawana

Tanabe Consulting Co., Ltd

Strategy Research Institute Segment & Region Marketing Chief Tang Tang Huang (Creation Support)

Methodology

The survey received 203 responses from corporate managers, executives, senior management, and individuals responsible for corporate planning departments across Japan. Conducted between January 15, 2024, and February 2, 2024, the study encompassed participants from all over Japan, including those based in overseas offices.

Services offered by Tanabe Consulting

With a population of approximately 130 million people, Japan is a safe, cutting-edge Asian country that offers a very attractive business environment. On the other hand, for foreign companies looking to enter the Japanese market, Japan is an unknown market, with unique business customs and business practices. In order to smoothly launch a business in Japan and penetrate the Japanese market, it is important to build an entry and market expansion strategy based on a clear understanding of the market size and future potential of your product, the competitive landscape and differentiation from competitors, and your supply chain model.

Tanabe Consulting is a pioneer in management consulting in Japan, with over 65 years of history and experience. Tanabe Consulting, with its thorough knowledge of the Japanese business environment, provides total support for expansion and development in the Japanese market.

（１） Japan Market Analysis

Tanabe Consulting, which operates in 10 regions throughout Japan, can provide highly accurate market research and information through consultants who are familiar with the relevant areas.

（２） Entry strategy planning

After market analysis, we will prioritize your expansion into the Japanese market based on your goals and your company’s strengths and core competencies. We determine the direction of entry, create a roadmap, and provide support for the materialization of your strategy.

（３） Marketing Implementation Support

Based on market analysis and entry strategies, we support your business in Japan by identifying potential partners and implementing effective website development and marketing initiatives in Japan, drawing on over 65 years of nationwide management consulting experience and network.

（４） Cross-border M&A

Based on our contacts and networks with companies throughout Japan, cultivated through more than 65 years of management consulting, we support capital alliances with companies that are suitable for gaining a position in the Japanese market.

About Tanabe Consulting Group (TCG)

Founded in 1957, TCG is a leading management consulting firm in Japan with over 65 years of history and achievements. Based on the management philosophy of “we love companies walk together with companies and work for company prosperity,” aiming to create values for the future society.

TCG primarily serves top management (executives and leaders) of large and medium-sized companies, as well as government and public organizations, having supported more than 17,000 companies since its founding. In the area of management consulting, TCG has developed a comprehensive consulting model that provides support for corporate management from strategy formulation (upstream) to the implementation and execution of management operations, such as DX in the field (midstream to downstream), with close ties to local communities throughout Japan.

Adhering to a client-centered philosophy of “All for Client Success,” TCG offers “team consulting,” where multiple professional consultants are selected to form a team tailored to address the specific management challenges of each company.