Nova Ransomware Strikes Indonesian Government Provider, Undersscoring Escalating Cyber Threats

Nova Ransomware Hits Indonesian Government Provider

On Apr 5, 2026, the ransomware group Nova added a government service provider in Indonesia to their data leak site. The published data includes personally identifiable information of thousands of citizens, according to Cyfirma researchers. The incident highlights how ransomware operators are turning attention to public sector entities in Indonesia. It is the latest in a string of attacks that have targeted Indonesian government ministries and agencies throughout 2025 and early 2026.

Surge in Attacks and 2025 Statistics

Cyberattacks in Indonesia surged to 5.5 billion incidents in 2025, a 714% increase over the 2020-2024 annual average, according to the National Cyber and Encryption Agency (BSSN). Government sector breaches lead the incident tally, reflecting both the value of public data and the attractiveness of softer security postures during the regulatory transition. Indonesia is the fastest-deteriorating of the five priority markets in the region, with attack activity growing 35% year-over-year in 2026. The sheer volume of incidents stretches limited local incident response teams and forces organizations to confront a structural gap between threat scale and defensive investment.

State Actors and AI-Weaponized Threats

State-aligned groups have escalated espionage campaigns, with Amaranth-Dragon exploiting CVE-2025-8088 through a fake civil servant salary decree archive timed to Indonesia's August 2025 pay increase. Shadow Campaigns compromised an Indonesian airline at Soekarnarian Hatta International Airport and government-linked mining systems. Meanwhile, AI-weaponized phishing success rates reached 54% to 60% during the reporting period, and deepfake incidents jumped 1400% year-over-year. These tools expand the attack surface far beyond traditional ransomware, giving threat actors the ability to impersonate officials and bypass human defenses at scale.

Ransomware Ecosystem Fragmentation

LockBit5 and CoinbaseCartel led observed incident volumes, each accounting for about 20% of tracked cases, with Everest and WorldLeaks forming a second tier at roughly 15% each. Double-extortion tactics combining encryption with data exfiltration remain standard. Smaller groups including Medusa, SpaceBears, and RansomHouse demonstrate that Indonesia's exposure extends well beyond the leading operators. The fragmented RaaS ecosystem forces defenders to hunt for a moving target rather than a handful of known threats.

Regulatory Transition Creates a Window of Exposure

Indonesia's Cybersecurity and Cyber Resilience Bill remained pending enactment as of May 2026, and the Personal Data Protection Agency had not yet reached full operational capacity. The gap between legislative intent and enforcement operationalization creates ambiguity in oversight authority. Organizations in early compliance preparation stages present softer security postures that are disproportionately attractive to both financially motivated and state-sponsored adversaries.

Economic Impact and Public Trust

The loss of citizen data undermines trust in government digital services, which are expanding rapidly under national e-government programs. A breach of a government service provider can disrupt access to health records, tax filing, and social assistance, all of which are critical to millions of Indonesians. The financial repercussions include remediation costs, potential regulatory fines, and the long-term brand damage that follows high-profile incidents.

Recommendations for Indonesian Defenders

BSSN urges immediate validation of remediation status for CVE-2026-41940, CVE-2023-20198, CVE-2021-42013, CVE-2017-9841, and CVE-2025-8088. Organizations should prioritize detection for confirmed active malware families including SURXRAT V5, Coretax RAT, ValleyRAT, and ABCDoor. Enforcing phishing-resistant multifactor authentication across privileged accounts and conducting continuous dark-web monitoring are essential steps to reduce exposure. Segmentation of IoT and operational technology networks from core enterprise systems will limit lateral movement once an attacker gains a foothold.

Why This Matters Now

The convergence of a surge in ransomware targeting public services, a spike in state-aligned espionage, and the rapid adoption of AI-driven attacks creates a perfect storm for Indonesian digital infrastructure. The regulatory transition window provides a temporary but exploitable opening that sophisticated actors are already probing. The stakes are not just financial; they include national security, public trust, and the trajectory of Indonesia's digital economy as it moves toward greater connectivity and e-government services.

Botnet Compromise and IoT Weakness

As of May 2026, Indonesia ranks seventh globally for active botnet compromise, with an estimated 68,000 to 85,000 compromised IP addresses across routers, DVRs, and Android IoT devices. The Aisuru and Kimwolf Mirai-derived botnets infected up to four million devices globally, with a significant concentration in Indonesia. These networks have facilitated DDoS attacks exceeding 200 million requests per second and reaching approximately 31.4 Tbps. Following international law enforcement disruptions in March 2026, successor variants Nexcorium and Tuxnokill rapidly emerged, confirming that structural IoT vulnerabilities remain unresolved. Defenders must treat consumer IoT infrastructure as hostile by default, enforcing firmware lifecycle management and network segmentation to contain lateral movement.

Mobile Banking Fraud and Tax-Themed Campaigns

The GoldFactory-attributed Coretax tax platform impersonation campaign escalated sharply in January 2026, targeting 67 million potential residents through WhatsApp impersonation, voice phishing, and malicious APK sideloading. GigaBud.RAT and MMRat served as the core mobile fraud toolkit, enabling remote banking session takeover. More than 1,600 malicious emails were recorded across tracked waves by SilverFox, a China-linked group deploying ValleyRAT and ABCDoor alongside fake tax authority correspondence. These campaigns reveal that mobile devices have become the primary financial attack surface, not a secondary concern. Organizations should deploy mobile threat defense and enforce sideloading restrictions through mobile device management.

Dark Web Exposure and Data Leak Markets

Underground forums show persistent elevated activity targeting Indonesian data sets. Confirmed offerings include a healthcare application dataset of roughly 192,000 records priced at USD 200, a state-owned fisheries enterprise personnel exposure, a government website database of 2,006 records, and an Education Ministry platform data set. Hacktivist activity peaked at 37 incidents in March 2026, down from earlier highs but still significant. The co-presence of politically motivated leaks and financially motivated data sales creates a dual threat: even if ransomware fails, stolen data sells independently, giving attackers two revenue paths. Continuous dark-web monitoring is not optional for government agencies and large enterprises holding citizen data.

Incident Response and Patch Priorities

BSSN recommends immediate validation of remediation for CVE-2026-41940, CVE-2023-20198, CVE-2021-42013, CVE-2017-9841, and CVE-2025-8088. Confluence was the most frequently targeted product with seven observed incidents in Indonesian environments. The co-presence of newly disclosed and long-standing unpatched vulnerabilities confirms a structural patch management deficit. Security teams should prioritize internet-facing assets, validate authentication logs for bypass attempts, and deploy detection rules for SURXRAT V5, Coretax RAT, MIMICRAT, ValleyRAT, and ABCDoor across endpoint and network platforms. For more details on the Nova incident, see the desk coverage. The breach echoes a similar 2024 ransomware attack on Indonesia's national data centre, reported by Reuters.