Ransomware in Indonesia is becoming more sophisticated, with perpetrators using aggressive tactics and AI.

By VELSICURO

28 September 2025

9 views

Nasional

Ransomware in Indonesia is becoming more sophisticated, with perpetrators using aggressive tactics and AI.

Palo Alto Networks, a global leader in cybersecurity, has released a report revealing the latest trends in ransomware attacks and digital extortion during the first quarter of 2025. The report highlights that cybercriminals are becoming more sophisticated, using new tactics such as psychological manipulation, internal infiltration, and even collaborating with state-sponsored actors to pressure victims into paying ransoms.

According to Philippa Cogswell of Palo Alto Networks, attacks no longer solely rely on data encryption. They now also use advanced tools that can disable security systems. This makes it essential for organizations in the Asia-Pacific region, including Indonesia, to increase their vigilance.

Threats in Indonesia are Rising; Is the Cyber Security Bill the Answer?

Data from BSSN (National Cyber and Crypto Agency) shows that throughout 2024, Indonesia recorded more than 330 million anomalous traffic incidents, with over 500,000 being ransomware attacks. These numbers underscore the high risk the country faces.

In response, Indonesia is drafting the Cyber Security and Resilience Bill (RUU KKS) to strengthen its national digital defense and law enforcement. Adi Rusli, Country Manager of Palo Alto Networks Indonesia, emphasizes that companies need to adopt a comprehensive approach, including full network visibility, rapid response, and security training for employees.

Key Ransomware Attack Trends in Q1 2025

The report identifies several important trends:

1. Smarter Deception: Attackers use manipulative tactics, such as fake data and sending ransom letters directly to company executives' homes, to increase pressure.
2. Manufacturing and Retail Are Primary Targets: The manufacturing sector remains the most frequent target, followed by retail and legal services.
3. Threats to Cloud and Endpoints: Attackers are now using "EDR killers" to disable endpoint security systems and aggressively attack cloud environments.
4. Use of AI and Insiders: There are indications that North Korean operators are using AI-based fake identities to infiltrate technology companies and steal critical source code.
5. RansomHub Is the Most Active Ransomware: The RansomHub ransomware variant dominated attack activity during the first quarter of 2025.

With increasingly sophisticated cyberattacks, this report serves as a crucial reminder to both the public and private sectors that investing in adaptive and integrated cybersecurity is an urgent necessity, not an option.

Source :beritanasional.com