Overview
Brain Cipher emerged as a ransomware threat actor in mid-2024 and rapidly achieved international visibility with an attack on Indonesia’s Pusat Data Nasional Sementara (PDNS 2) — the temporary national data centre — that disrupted government services across multiple ministries for several weeks. The attack affected immigration, student financial aid, and other government services, demonstrating both the operational reach of the group and the catastrophic downstream impact of ransomware against national data infrastructure.
The group’s technical foundation appears derived from LockBit 3.0 (LockBit Black) leaked builder code, which has enabled a number of new ransomware families since the builder was leaked in 2022. Brain Cipher has maintained active operations into 2025 and 2026, claiming victims across government, healthcare, and education sectors globally.
The PDNS 2 Attack (June 2024)
The attack on Indonesia’s national data centre was the incident that put Brain Cipher on the threat intelligence map. PDNS 2, operated by the Ministry of Communication and Information Technology (Kominfo), serves as a cloud hub for data from hundreds of government agencies.
Brain Cipher disrupted the centre in late June 2024, encrypting data and demanding an 8 million USD ransom. The attack affected over 200 government agencies and temporarily brought down the immigration system, causing delays at airports across the country. Student financial aid (KIP Kuliah) and other citizen-facing services were also impacted.
The Indonesian government declined to pay. Several weeks later, Brain Cipher released the decryption key for the PDNS 2 data without payment — a highly unusual move that the group framed as a demonstration of good faith and an “act of responsibility to show that our keys work.” Whether this was a strategic PR move to build credibility, a response to political pressure, or a genuine act of remorse is unclear. The decryption key did allow recovery of encrypted data.
The incident generated significant national and international coverage and prompted parliamentary hearings in Indonesia on critical infrastructure cybersecurity.
Technical Profile
Brain Cipher’s ransomware payload is built on the LockBit 3.0 leaked builder code. This code base features:
Encryption: ChaCha20 symmetric encryption for file content, RSA-4096 for key protection. Files are renamed with a custom extension after encryption.
VMware ESXi targeting: Brain Cipher has demonstrated the ability to deploy against ESXi hypervisors, following the pattern common to post-LockBit-3 ransomware families. ESXi attacks maximise impact in virtualised environments by encrypting multiple virtual machines simultaneously.
Evasion: Standard LockBit-derived evasion techniques including shadow copy deletion (vssadmin.exe delete shadows /all /quiet), security software enumeration and termination, and self-deletion after execution.
Ransom note: Victims receive a Brain Cipher-branded ransom note directing them to a Tor-based negotiation portal. The group operates a standard double-extortion model — files are encrypted and data is exfiltrated prior to encryption, with the threat of public disclosure on the leak site if payment is not made.
Initial access: Brain Cipher does not appear to operate its own initial access infrastructure. Like most RaaS operations at this scale, affiliates handle initial access through their preferred methods — phishing, exploitation of internet-facing vulnerabilities, and purchased access from initial access brokers.
Data Leak Site and Extortion Model
Brain Cipher operates a Tor-based data leak site (“Brain Cipher Data Leaks” / “The Ransom Blog” in some references) where exfiltrated data from non-paying victims is published. The site has been used to apply pressure on victims through staged releases — publishing a portion of data publicly while threatening full disclosure.
The group follows the standard modern double extortion model:
- Initial access and persistence establishment
- Lateral movement and data exfiltration
- Ransomware deployment and encryption
- Ransom demand with threat of data release
- Publication of partial or full exfiltrated data for non-paying victims
The group has listed victims across multiple countries including the United States, United Kingdom, Australia, and various Asian and European targets alongside the Indonesian government incident.
Targeting Profile
Based on reported victims and claimed disclosures on the leak site:
Primary sectors: Government and public administration, healthcare, education.
Geographic spread: Brain Cipher has shown international targeting scope from its earliest operations, not limiting activity to any specific region. This is consistent with an affiliate-based RaaS model where individual affiliates determine targeting.
Organisation size: Victims range from large government entities (PDNS 2) to mid-sized organisations in healthcare and education. The group does not appear to specialise in large-enterprise or SMB targeting exclusively.
Ransom demands: Demands appear to range from low six-figures to 8 million USD (the PDNS 2 demand), suggesting demand sizing is calibrated to perceived victim payment capacity.
Claimed LockBit Connection
Some threat intelligence reporting has noted the LockBit 3.0 code lineage and speculated on affiliate or personnel overlap with former LockBit affiliates. This is plausible given the leaked builder’s widespread use, but direct personnel connections have not been confirmed publicly. Using the LockBit 3.0 builder does not in itself indicate any relationship with the LockBit organisation.
Defensive Recommendations
For government and public sector organisations:
The PDNS 2 attack highlights the catastrophic potential of ransomware against centralised government data infrastructure. Key mitigations:
- Ensure critical government services do not have single points of failure in shared data infrastructure
- Maintain offline backups tested against restoration scenarios (not just backup-to-cloud, which may be equally accessible to ransomware)
- Apply network segmentation so that a single compromised environment cannot traverse into all connected agencies
For all sectors:
- ESXi hypervisors should be patched current and not directly internet-accessible; management interfaces (vSphere) should require VPN and MFA
- Shadow copy and backup deletion commands (
vssadmin,wbadmin) should trigger alerts in SIEM; these are near-universally present in ransomware kill chains - Implement immutable backup storage — snapshots that cannot be deleted by the compromised account
Current Activity Assessment
Brain Cipher remains operationally active into 2026 with continued victim disclosures on their leak site. The group has not reached the victim volume of top-tier RaaS operations like RansomHub or LockBit at peak, but its demonstrated willingness to attack high-visibility government infrastructure and its international targeting scope make it a material threat for public sector organisations.
The release of the PDNS 2 decryption key without payment was atypical and has not been repeated in subsequent victims, suggesting it was a one-time strategic decision specific to the political pressure around that incident rather than an operational pattern.