Indonesia Financial Sector Malware Attacks: Parliament to Summon BSSN, Hirudo Trojan Swaps Bank Apps

Indonesia's parliament will summon the national cyber agency, BSSN, after FortiGuard's public threat map counted 1.2 million attack attempts on finance and banking in the 24 hours to 20:00 WIB on 9 November. Separately, ThreatFabric has documented Hirudo, an Android trojan that swaps the apps of seven Indonesian banks for tampered copies on customers' phones. A member of the same parliamentary commission said on 9 November that no breach of the national banking system had been reported.

OJK put banks on 24-hour alert on 8 November, and on 9 November Bank Indonesia told payment operators to report incidents faster.

The malware: Hirudo

ThreatFabric disclosed Hirudo on 14 October. Instead of drawing a fake login screen over a banking app, it opens Android's uninstaller for the real one and puts in its place "a modified copy that quietly disables the bank's own security checks". The trojan tracks 42 financial apps, but "only eight Indonesian apps, across seven banks, have dedicated replacement downloads". Its credential targets also cover China, India, Mexico, Morocco and Thailand.

It arrives inside lure apps, among them a shopping app called Shopora and the short-drama apps ZoyaTV and KoiShort, and then pushes a fake update. ThreatFabric found the operators' backend open and says data captured there in August held "thousands of credential and device records".

Which seven banks isn't public. detikInet reports that "nama bank yang menjadi sasaran tidak diungkap secara terbuka" (the targeted banks' names were not disclosed), and BleepingComputer says "the victim count remains unknown".

Parliament and the banks

Oleh Soleh of Commission I told Katadata that the commission will summon BSSN to set out the national threat picture and how it works with OJK, Bank Indonesia and the communications ministry. No hearing date has been given, and BSSN hadn't responded to Katadata by publication. The commission also wants the cyber security and resilience bill, RUU KKS, finished; it's in first-stage deliberation in the DPR.

CIMB Niaga's president director, Lani Darmawan, told The Jakarta Post, in a report carried by The Star, that the bank is issuing new security patches "in keeping with the regulator's instruction".