- Malanta.ai uncovers 14-year-old cybercrime infrastructure in Indonesia that resembles a state-funded operation
- The network spans over 320,000 domains, hijacked government subdomains, and thousands loaded with Android malware.
- Company stole over 50,000 gambling credentials, used AWS and Firebase for C2, and raised suspicions in nation states
Security researchers have discovered a massive cybercrime infrastructure in Indonesia that has been operating continuously for more than 14 years.
The length of the operation, the domains involved, the distribution of malware and the data being sold on the black market are so extensive that Malanta.ai researchers say the company looks more like a national government company than “typical” cybercriminals.
“What started as a simple gambling website has evolved into a sophisticated, well-funded and state-sponsored global attack infrastructure operating across the web, cloud and mobile devices,” Malanta said in a recently published blog.
Is the government involved?
The operation has reportedly been going on since at least 2011. The operators controlled more than 320,000 domains, of which more than 90,000 were hacked and hijacked. They monitored more than 1,400 hacked subdomains and 236,000 purchases used to redirect users to illegal gaming platforms.
To make matters worse, some of the compromised subdomains were located on government and corporate servers. In some cases, threat actors deployed NGINX-based reverse proxies to disable TLS connections to legitimate government domain names, thereby disguising their C2 traffic as legitimate government messages.
Then there’s the malware ecosystem: Researchers found “thousands” of Android malware distributed through public infrastructure (Amazon Web Services S3 bucket).
These apps act as droppers, posing as legitimate gaming platforms while deploying malware that provides full access to compromised devices in the background. The backdoors received their commands directly from another piece of public infrastructure: Google’s Firebase cloud messaging service.
This led to the theft of more than 50,000 login credentials from gambling platforms, countless infected Android devices and subdomains hijacked on the dark web.
“What if this ecosystem wasn’t just cybercrime?” The researchers speculated.
Overall, the scope, scale, and financial support of these infrastructures are much more in line with the capabilities typically associated with state-sponsored threat actors.
through Cyber Security News
The best antivirus for any budget
Follow TechRadar on Google News I Add us as your preferred source Get news, reviews and opinions from our experts in your feed. Don’t forget to click the follow button!
And, of course, you can Siga TechRadar on TikTok Get our regular updates in the form of news, reviews, unboxing and videos. WhatsApp very
