Threat Actor: Unknown | Unknown
Victim: Badan Intelijen Strategis (Indonesian Military Strategic Intelligence Agency) and Indonesia Automatic Fingerprint Identification System (INAFIS) | Badan Intelijen Strategis and INAFIS
Price: $1,000 for user database files (.SQL), $7,000 for secret documents (.ZIP)
Exfiltrated Data Type: User database files (.SQL), confidential documents (.PDF and .DOC), INAFIS faces member images (.PNG), INAFIS fingerprints member images (.WSQ), INAFIS SpringBoot application (.JAR)
Key Points :
- A threat actor claims to be selling highly sensitive data from the Badan Intelijen Strategis and the Indonesia Automatic Fingerprint Identification System (INAFIS).
- The compromised files include a user database containing personal information and confidential documents from military intelligence members.
- The threat actor is accepting payments only in cryptocurrency and can be contacted via Telegram.
A threat actor claims to be selling highly sensitive data from the Badan Intelijen Strategis (Indonesian Military Strategic Intelligence Agency) and the Indonesia Automatic Fingerprint Identification System (INAFIS).
Badan Intelijen Strategis Data
The threat actor has allegedly posted a sample of the data for download and is offering the full dataset for sale. The Strategic Intelligence Agency is responsible for military intelligence and operates under the command of the Indonesian National Army Headquarters.
Compromised Files:
- 2,000 user database (.SQL) containing data such as:
- id, name, task force, rank, username, email, password, avatar, tokens, phone number, IMEI, last seen, generation, NRP, device, manufacture, OS, app version
- Confidential (secret) documents from military intelligence members (.PDF and .DOC) from 2020 to 2022
Pricing:
- User database files (.SQL), 773KB: $1,000
- Secret documents (.ZIP), 33.7GB: $7,000
- Free sample data available on the forum
The threat actor states that they are accepting payments only in cryptocurrency, specifically XMR (Monero), and can be contacted via Telegram.
INAFIS Data
The same threat actor also claims to be selling data from INAFIS (Indonesia Automatic Fingerprint Identification System), which is crucial for the identification process through fingerprints and focuses on collecting authentic data on the Indonesian population.
Compromised Files:
- INAFIS faces member images (.PNG) with email
- INAFIS fingerprints member images (.WSQ) with email
- INAFIS SpringBoot application (.JAR) with database configuration properties
Pricing:
- INAFIS SpringBoot application with configuration: $1,000
- Potential to access API/DB with 200+ million Indonesian ID card numbers through reverse engineering the application
The threat actor further claims that anyone interested in the INAFIS data can contact them via Telegram.
The severity of these breaches highlights significant security vulnerabilities and the potential for misuse of sensitive military and biometric data.
The post Threat Actor Claims to Sell Data of Indonesian Military Intelligence Agency and INAFIS (Indonesia Automatic Fingerprint Identification System) appeared first on Daily Dark Web.