Conti ransomware gang started leaking files stolen from Bank Indonesia

The central bank of the Republic of Indonesia, Bank Indonesia, confirmed the ransomware attack that hit it in December.

Bank Indonesia confirmed that it was the victim of a ransomware attack that took place last month. The Conti ransomware gang claimed the attack and leaked some allegedly stolen files as proof of the security breach.

A bank spokesperson told Reuters that the ransomware attack did not impact services.

“We were attacked, but so far so good as we took anticipatory measures and most importantly public services at Bank Indonesia were not disrupted at all,” its spokesperson Erwin Haryono told reporters.

According to CNN Indonesia, a spokesman for Indonesia’s cyber agency (BSSN) said no critical data was leaked and the attacks occurred in a Bank Indonesia office on Sumatra island.

Conti operators have added Bank Indonesia to the list of victims on their Tor leaks site, the gang claims to have stolen 13.88 GB worth of files.

Conti operators run a private Ransomware-as-a-Service (RaaS), the malware appeared in the threat landscape at the end of December 2019 and was distributed through TrickBot infections. Experts speculate the operators are members of a Russia-based cybercrime group known as Wizard Spider.

Since August 2020, the group has launched its leak site to threaten its victim to release the stolen data. Conti operators claimed to have already compromised at least 500 organisations worldwide.

In December 2021, the Australian Cyber Security Centre (ACSC) warns of Conti ransomware attacks against multiple Australian organizations from various sectors since November.

The ACSC also published a ransomware profile for the Conti gang that contains information about the operations of the group, including mitigations.

In September, CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) also warned of an increased number of Conti gang attacks against US organizations.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Conti ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]