{
  "name": "Indonesian Banking Sector Threat Landscape",
  "slug": "indonesian-banking-sector-threat-landscape",
  "description": "Indonesia's Banking, Financial Services, and Insurance sector faced significant cyber threats throughout 2026, including multiple alleged data breaches targeting major banking institutions and fintech platforms. Underground forums advertised compromised datasets containing customer information, account details, and sensitive documents, with varying levels of validation. Ransomware groups ICARUS and The Gentleman conducted extortion campaigns against financial organizations. China-linked APT groups including SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, and Shadow Campaigns demonstrated sophisticated capabilities through phishing operations, supply chain compromises, and zero-day exploitation. These state-aligned actors deployed advanced malware such as ValleyRAT, ABCDoor, LOTUSLITE, and custom backdoors for long-term espionage. The expanding digital banking ecosystem and regional financial connectivity have increased attack surfaces, requiring enhanced cyber resilience, continuous monitoring, a...",
  "published": "2026-07-09T17:50:08.057000+00:00",
  "created_at": "2026-07-10T07:36:46.044000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-10T07:36:46.044000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "abcdoor",
    "amaranth loader",
    "apt espionage",
    "bfsi sector",
    "chrysalis",
    "cobalt strike",
    "cve-2025-8088",
    "data breach",
    "financial cybercrime",
    "havoc",
    "indonesian banking",
    "lotuslite",
    "phishing campaigns",
    "ransomware extortion",
    "rustsl",
    "shadowguard",
    "supply chain compromise",
    "tgamaranth rat",
    "valleyrat"
  ],
  "tags": [],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "67c94d1a-bec7-4084-8fb9-15dd2dc6fb57",
        "name": "CVE-2025-8088"
      }
    ],
    "indicators": [
      {
        "id": "6a41d4c9-5eda-45ba-b654-df85607eb4bb",
        "name": "pr0fu5a.me"
      },
      {
        "id": "501d91f6-51c6-4397-9d32-76d986bc8315",
        "name": "msonline.help"
      },
      {
        "id": "357bba8d-7b1d-4cdb-a04f-424f22fb89cb",
        "name": "dog3rj.tech"
      },
      {
        "id": "9e0d22d7-1f58-412a-9f4c-aa60c65a3603",
        "name": "editor.gleeze.com"
      },
      {
        "id": "4556e682-9b8f-43c0-9a8a-fe3a38a1b73b",
        "name": "zamstats.me"
      },
      {
        "id": "d02fcbdd-fd10-431b-a85d-0dc6f0ae3b5d",
        "name": "gouvn.me"
      },
      {
        "id": "f55e08b6-5cf3-41f0-8d62-f2924167240b",
        "name": "abwxjp5.me"
      },
      {
        "id": "50ef3ada-3243-404e-a488-eb3eacc2c502",
        "name": "vnc.kcii2.com"
      },
      {
        "id": "e692bec5-eb44-469b-8143-e56272612912",
        "name": "www.cosmosmusic.com"
      },
      {
        "id": "37e85c4c-f723-492f-b80b-ca89dcc4fc44",
        "name": "abc.petitechanson.com"
      },
      {
        "id": "52998093-f5bb-48a9-ab12-5ee57fc9b2e9",
        "name": "abc.woopami.com"
      },
      {
        "id": "d9cab5c7-20da-43aa-a304-e2d8f1024386",
        "name": "emezonhe.me"
      },
      {
        "id": "043e2376-ee5c-480a-888a-090021c95f32",
        "name": "abc.ilptour.com"
      },
      {
        "id": "078d2421-8405-4749-a3af-e3f7c8c306f8",
        "name": "gpsfinance.co.id"
      },
      {
        "id": "60dc9501-2e01-45e7-bcbc-48d58396dc49",
        "name": "roldco.com"
      },
      {
        "id": "f33153da-b9db-4a7d-befb-62f04a36ae69",
        "name": "abc.doublemobile.com"
      },
      {
        "id": "a9b2bf94-2d99-475f-b8b5-7fd93eb7991e",
        "name": "abc.sudsmama.com"
      },
      {
        "id": "70f5a744-88cb-49df-a960-73d084b2c8ce",
        "name": "servgate.me"
      },
      {
        "id": "2c82242f-a4b5-43f6-b3ff-de198f6eba16",
        "name": "abc.3mkorealtd.com"
      },
      {
        "id": "48ffc1b7-6b14-42a4-896f-ee52c2d2e6f9",
        "name": "mcagov.cc"
      },
      {
        "id": "ed247676-958d-4042-995d-4cf4c9541b75",
        "name": "pickupweb.me"
      },
      {
        "id": "15ba4b65-1bb4-4265-8f9b-4ae4ca1a3262",
        "name": "q74vn.live"
      },
      {
        "id": "229b1c5e-61d5-4a35-9bc5-065a99eb8df1",
        "name": "188.127.251.171"
      },
      {
        "id": "48d390c4-cb3e-4e81-a8fe-984c3c630124",
        "name": "abc.fetish-friends.com"
      },
      {
        "id": "9a67bb95-75cf-450f-abb8-c2509fbabdb3",
        "name": "zrheblirsy.me"
      },
      {
        "id": "f2b3518e-b1f2-4bd7-a9bc-63303a8ea1fb",
        "name": "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
      },
      {
        "id": "f785ac8d-a961-4c4d-8e03-4eacfb03fb44",
        "name": "skycloudcenter.com"
      },
      {
        "id": "be62203b-7b98-41ac-85ac-61d555a4c0e4",
        "name": "abc.haijing88.com"
      },
      {
        "id": "d6fb825b-93c6-4055-b982-f5351150a2e0",
        "name": "59.110.7.32"
      }
    ],
    "intrusion_sets": [
      {
        "id": "16473ff3-2ddb-431b-981a-93d982cbb9f6",
        "name": "SilverFox, Mustang Panda, Amaranth-Dragon, Lotus Blossom, Shadow Campaigns, TripleX, ICARUS, The Gen",
        "slug": "silverfox-mustang-panda-amaranth-dragon-lotus-blossom-shadow-campaigns-triplex-icarus-the-gen"
      }
    ],
    "attack_patterns": [
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "064e053c-16fd-4118-8733-784f2b3ea9ce",
        "name": "TGAmaranth RAT",
        "slug": "tgamaranth-rat"
      },
      {
        "id": "b09f5343-ec83-482b-86c5-eb6ecc13eeec",
        "name": "Havoc",
        "slug": "havoc"
      },
      {
        "id": "fffe4282-f703-4109-ae2e-80f30f2951a8",
        "name": "ShadowGuard",
        "slug": "shadowguard"
      },
      {
        "id": "f8879be0-dea7-4e8d-9aba-78c8ac8c6207",
        "name": "ValleyRAT",
        "slug": "valleyrat"
      },
      {
        "id": "4ee3e1ea-16b8-42ed-96cb-f1f8e9c2693b",
        "name": "Chrysalis",
        "slug": "chrysalis"
      },
      {
        "id": "ab138766-9b64-4880-87fb-1942a709d778",
        "name": "Cobalt Strike - S0154",
        "slug": "cobalt-strike-s0154"
      },
      {
        "id": "942e4f14-5f82-4453-a967-730eef045458",
        "name": "Amaranth Loader",
        "slug": "amaranth-loader"
      },
      {
        "id": "d9d115e9-0360-475d-9c34-93a3393a032d",
        "name": "ABCDoor",
        "slug": "abcdoor"
      },
      {
        "id": "088f69a7-0dad-4ce7-b8b3-86a182a09284",
        "name": "RustSL",
        "slug": "rustsl"
      },
      {
        "id": "01673717-78f1-4b67-a642-8260806d76e3",
        "name": "LOTUSLITE",
        "slug": "lotuslite"
      }
    ],
    "observables": [
      {
        "id": "b2187819-e024-4ec0-a84c-c5259f4dd817",
        "name": "dog3rj.tech"
      },
      {
        "id": "a87776b9-f73e-4560-98c7-e34337925742",
        "name": "zrheblirsy.me"
      },
      {
        "id": "51bf13e2-65ae-4ab3-b1cd-ee508722924d",
        "name": "pr0fu5a.me"
      },
      {
        "id": "8cec959d-3b57-437a-bc5f-83878370b1bf",
        "name": "pickupweb.me"
      },
      {
        "id": "50371610-ccfa-4f11-8604-d48dd5e97c59",
        "name": "zamstats.me"
      },
      {
        "id": "b4ad8812-8254-42d7-a293-e35221d5a2c6",
        "name": "servgate.me"
      },
      {
        "id": "b939fafb-a31d-42e5-9bdb-6455f3962446",
        "name": "abwxjp5.me"
      },
      {
        "id": "5797acbe-e058-4a18-a0d0-331e7a731433",
        "name": "gouvn.me"
      },
      {
        "id": "12be535b-9768-4675-a9da-b7440e06852e",
        "name": "gpsfinance.co.id"
      },
      {
        "id": "4557ee91-d61e-4c9a-b21b-6121b44e15b2",
        "name": "roldco.com"
      },
      {
        "id": "176c0bed-d741-4732-8fe7-c4bdd7a34523",
        "name": "skycloudcenter.com"
      },
      {
        "id": "d1f76c05-fa3d-401d-a242-855ca746c234",
        "name": "msonline.help"
      },
      {
        "id": "6acd080b-d0d9-488b-ac56-0e2e4afebcc3",
        "name": "emezonhe.me"
      },
      {
        "id": "e62a8a94-d6bd-43f0-b30b-920ae5097139",
        "name": "q74vn.live"
      },
      {
        "id": "3775979e-96dd-4c04-874a-fb7107b046d0",
        "name": "mcagov.cc"
      },
      {
        "id": "52310783-cdf0-4e04-953e-1cecfd4be0b4",
        "name": "abc.petitechanson.com"
      },
      {
        "id": "232635e5-175b-4db9-92ec-307e65eb8904",
        "name": "abc.3mkorealtd.com"
      },
      {
        "id": "9d8af06e-1df3-4f16-9c10-46338e7853b3",
        "name": "abc.sudsmama.com"
      },
      {
        "id": "9e33d850-a72c-4293-a668-6f949f0523d2",
        "name": "abc.fetish-friends.com"
      },
      {
        "id": "48143aac-e35c-4010-be39-249f49ba61ab",
        "name": "abc.ilptour.com"
      },
      {
        "id": "1d8643fc-2a26-450d-8ac4-0c0f35e9d2ce",
        "name": "www.cosmosmusic.com"
      },
      {
        "id": "3ac8bab3-2f11-45e4-a4da-0acced4b919a",
        "name": "abc.woopami.com"
      },
      {
        "id": "76c4c4c7-39c2-445f-a6ea-eca968486236",
        "name": "vnc.kcii2.com"
      },
      {
        "id": "86bf4554-cca4-47f7-b861-68988ca2dc8c",
        "name": "abc.haijing88.com"
      },
      {
        "id": "0536d5b6-aac5-43a7-b332-54aaba3206f6",
        "name": "abc.doublemobile.com"
      },
      {
        "id": "47cec2fd-c480-4588-bf29-769e45f11337",
        "name": "editor.gleeze.com"
      },
      {
        "id": "1deeeac8-17b6-4038-a2b7-7630073c78b3",
        "name": "59.110.7.32"
      },
      {
        "id": "b32af7c2-368b-4cb8-8899-be84df708062",
        "name": "188.127.251.171"
      }
    ]
  },
  "external_refs": [
    {
      "id": "8b39ebca-33f5-4c10-9e02-586da1b9ace2",
      "standard_id": "external-reference--38457929-02b3-5d2a-85b5-fd2c6d30ceab",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-10T07:36:37.422Z",
      "modified": "2026-07-10T07:36:37.422Z",
      "createdById": null
    },
    {
      "id": "bf9d8fb9-d73a-4485-9760-7f128027ba21",
      "standard_id": "external-reference--b308d6a7-0a7d-536d-87c5-f83b0976b045",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a4fdf500b5e6dffde939998",
      "hash": null,
      "external_id": "6a4fdf500b5e6dffde939998",
      "created": "2026-07-10T07:36:37.381Z",
      "modified": "2026-07-10T07:36:37.381Z",
      "createdById": null
    }
  ]
}