[June-03-2025] Daily Cybersecurity Threat Report

Posted on

1. Executive Summary

The past 24 hours have seen a significant volume of cyber incidents, predominantly data leaks and breaches, alongside several instances of initial access sales and vulnerability disclosures. The threat landscape is characterized by a diverse array of actors, ranging from financially motivated cybercriminals to hacktivist groups, primarily targeting organizations and individuals across various sectors and geographies. A notable concentration of incidents has impacted entities in Indonesia and India, with significant data compromises affecting government, financial, and telecommunications sectors.

Key Takeaways

The incidents highlight the pervasive nature of data exfiltration, with sensitive personal and organizational data being a prime target for sale on underground forums. The cryptocurrency sector, government bodies, and educational institutions are particularly vulnerable. Initial access brokers continue to facilitate further malicious activities by selling unauthorized access to compromised systems. Furthermore, the emergence of new vulnerabilities, including zero-days, underscores the constant need for vigilance and proactive patching.

Broader Implications

The sheer volume and variety of incidents observed within a single 24-hour period underscore the persistent and evolving nature of cyber threats. The widespread availability of leaked data poses significant risks for identity theft, fraud, and targeted phishing campaigns. For organizations, these breaches can lead to severe reputational damage, regulatory fines, and substantial financial losses. The targeting of critical government and financial infrastructure, particularly in countries like Indonesia, suggests potential for broader societal disruption and highlights the need for enhanced national cybersecurity strategies. The continuous trade of initial access and vulnerabilities on the dark web indicates a robust underground economy that fuels further cybercriminal activities, making a multi-layered and adaptive defense strategy more critical than ever.

2. Daily Threat Overview

This section provides a high-level summary of all identified cybersecurity incidents within the past 24 hours, offering a quick reference for critical details.

Incident IDAffected EntityBreach TypeAttack VectorPrimary Threat Actor
20250603-001Crypto Indonesia UsersData LeakAlleged SaleTimDBS
20250603-002CoinbaseData LeakAlleged SaleTimDBS
20250603-003Global Crypto UsersData LeakAlleged SaleTimDBS
20250603-004SMK NEGERI 2 KASIHANData BreachAlleged Data AcquisitionXsvs_Malaikat
20250603-005DISNAKER KOTA DEPOKData BreachAlleged Database LeakXsvs_Malaikat
20250603-006Pringsewu RegencyData BreachAlleged Database LeakXsvs_Malaikat
20250603-007GreenVelopeData BreachAlleged Data AcquisitionClayOxtymus1337
20250603-008Unidentified Shop In USAInitial AccessAlleged Access Salebonafire
20250603-009Hyderabad TaxiData BreachAlleged Database LeakINDOHAXSEC
20250603-010General Paper Goods Co. (GPG)Initial AccessAlleged RDweb Access Salegadji
20250603-011Unidentified Shop in GreeceInitial AccessAlleged Access Salemaverickslab
20250603-012French CitizensData LeakAlleged Data Leakcourtika
20250603-013OnfidoData BreachAlleged Data Breachdariusvirus1122
20250603-014Prabharani Institute of EducationData BreachAlleged Database AcquisitionINDOHAXSEC
20250603-015N/AMalwareAlleged SMS Spoofer Saleshadyrealone
20250603-016Marie LouisDefacementAlleged Website DefacementTeam 1722
20250603-017GPS Tech Co., Ltd.Data BreachAlleged Database BreachNDT SEC
20250603-018Lex Logos Romania SRLData BreachAlleged Database SaleSentap
20250603-019Indian CitizensData LeakAlleged Data Leakhagilo2748
20250603-020French CitizensData LeakAlleged Database Leakdecojo4605
20250603-021Mahkamah Agung Republik IndonesiaData BreachAlleged Database LeakDigitalGhost
20250603-022N/AData LeakAlleged Document Collection LeakMatteo
20250603-023Dewan Perwakilan Rakyat Republik IndonesiaData BreachAlleged Database BreachDigitalGhost
20250603-024Unidentified China Natural Gas CompanyData LeakAlleged Data Leakheiwukoong
20250603-025Smartfren TelecomInitial AccessAlleged Panel Access SaleCaptainfen
20250603-026TelkomselInitial AccessAlleged Panel Access SaleCaptainfen
20250603-0273 Doctors Know YouInitial AccessAlleged Unauthorized Access SaleNDT SEC
20250603-028State Police of the Republic of IndonesiaData BreachAlleged Data LeakDigitalGhost
20250603-029Directorate General of TaxationData BreachAlleged Database BreachDigitalGhost
20250603-030Cassino88Data BreachAlleged Data BreachDigitalGhost
20250603-031Buffalo City Metropolitan MunicipalityData BreachAlleged Data BreachCyberVolk Arcanum
20250603-032Bank Syariah IndonesiaData BreachAlleged Database BreachDigitalGhost
20250603-033Majelis Permusyawaratan Rakyat Republik Indonesia (MPR RI)Data BreachAlleged Data BreachDigitalGhost
20250603-034Verified Casino Users from AsiaData LeakAlleged Database Leakbaddie
20250603-035Pardos ChickenData BreachAlleged Data Extractionabzerocool
20250603-036ClaroData BreachAlleged Database BreachDedale
20250603-037FSTE Université Moulay IsmaïlData BreachAlleged Database Leakr3i
20250603-038Puntadewa SurabayaData BreachAlleged Database BreachVirXploit24
20250603-039Nigerian Banking PortalsData BreachAlleged Unauthorized Accesskevin_Vladimir
20250603-040Swamy Abedhanandha Vidhyashram CBSE SchoolInitial AccessAlleged Admin Panel AccessBABAYO EROR SYSTEM
20250603-041TerraMaster NASVulnerabilityAlleged 0-day Exploit Saleskart7
20250603-042Tunisian Government SystemVulnerabilityAlleged 0-day Exploit SaleDedSec

Daily Threat Overview Table

Export to Sheets

3. Detailed Incident Analysis

This section provides an in-depth analysis of each identified incident, incorporating specific details and enriched threat actor profiles.

3.1. Incident ID: 20250603-001 – Alleged sale of Crypto Indonesia Phone Numbers

Affected Entity & Date: Indonesian crypto users, 2025-06-03 13:11:35Z. Category & Content: Data Leak. A threat actor claims to be selling a database containing 30,000 phone numbers linked to Indonesian crypto users. The data reportedly originates from crypto casinos, KuCoin, and other cryptocurrency-related platforms. Network: openweb Threat Actor Profile: TimDBS TimDBS appears to be a financially motivated cybercriminal, specializing in the acquisition and sale of sensitive user data from cryptocurrency platforms and related services. While specific details about their modus operandi are not available in the provided research, their activities align with common cybercriminal objectives of financial gain through data monetization.[1, 2] Supporting Evidence & References:

3.2. Incident ID: 20250603-002 – Alleged data sale of Coinbase

Affected Entity & Date: Coinbase (USA, Financial Services), 2025-06-03 12:47:47Z. Category & Content: Data Leak. The threat actor claims to be selling user data from Coinbase. The leaked information includes names, emails, phone numbers. NB: The organization was breached before. Network: openweb Threat Actor Profile: TimDBS As observed in other incidents, TimDBS is likely a financially motivated cybercriminal focused on exploiting vulnerabilities in cryptocurrency platforms to exfiltrate and sell user data. Their repeated targeting of crypto-related entities, including a major exchange like Coinbase, suggests a specialization in this high-value sector.[1, 2] Supporting Evidence & References:

3.3. Incident ID: 20250603-003 – Alleged sale of 5 million crypto phone numbers

Affected Entity & Date: Global crypto users, 2025-06-03 12:12:57Z. Category & Content: Data Leak. The threat actor claims to have leaked 5 million crypto phone numbers worldwide, including data from KuCoin and Coinbase. Network: openweb Threat Actor Profile: TimDBS TimDBS continues to demonstrate a focus on large-scale data leaks from the cryptocurrency ecosystem. The claim of 5 million phone numbers from multiple platforms, including previously targeted ones like KuCoin and Coinbase, indicates a persistent and potentially sophisticated operation aimed at maximizing financial gain through the sale of extensive user datasets.[1, 2] Supporting Evidence & References:

3.4. Incident ID: 20250603-004 – Alleged data breach of SMK NEGERI 2 KASIHAN

Affected Entity & Date: SMK NEGERI 2 KASIHAN (Indonesia, Education), 2025-06-03 12:05:28Z. Category & Content: Data Breach. The threat actor claims to have obtained the data from SMK NEGERI 2 KASIHAN. The compromised data consists of sensitive personal data. Network: openweb Threat Actor Profile: Xsvs_Malaikat Xsvs_Malaikat appears to be a cybercriminal or hacktivist group targeting Indonesian entities, particularly in the education and government sectors. Their motivation seems to be data exfiltration, likely for sale or to achieve specific objectives, aligning with common cybercriminal activities.[3] Supporting Evidence & References:

3.5. Incident ID: 20250603-005 – Alleged database leak of DISNAKER KOTA DEPOK

Affected Entity & Date: DISNAKER KOTA DEPOK (Indonesia, Government Administration), 2025-06-03 12:02:07Z. Category & Content: Data Breach. The threat actor claims to have leaked the database of DISNAKER KOTA DEPOK. Network: openweb Threat Actor Profile: Xsvs_Malaikat Continuing their focus on Indonesian government entities, Xsvs_Malaikat demonstrates a pattern of targeting public administration databases. This activity suggests either financially motivated data sales or hacktivism aimed at disrupting government operations or exposing information.[3] Supporting Evidence & References:

3.6. Incident ID: 20250603-006 – Alleged database leak of Pringsewu Regency

Affected Entity & Date: Pringsewu Regency (Indonesia, Government Administration), 2025-06-03 11:54:07Z. Category & Content: Data Breach. The threat actor claims to have leaked the database of Pringsewu Regency. Network: openweb Threat Actor Profile: Xsvs_Malaikat Xsvs_Malaikat’s repeated targeting of Indonesian government bodies, including local regencies, indicates a sustained campaign against public sector data. This consistent focus suggests a strategic approach to acquiring and leaking sensitive government information.[3] Supporting Evidence & References:

3.7. Incident ID: 20250603-007 – Alleged Data Breach of GreenVelope

Affected Entity & Date: GreenVelope (USA, Events Services), 2025-06-03 11:53:19Z. Category & Content: Data Breach. The threat actor claims to have obtained the data from GreenVelope. The compromised data is of 95MB consisting sensitive personal information such as Name, email, phone, address etc. Network: openweb Threat Actor Profile: ClayOxtymus1337 ClayOxtymus1337 appears to be a financially motivated cybercriminal focused on data breaches for the purpose of selling sensitive personal information. Their targeting of an events services company suggests an opportunistic approach to acquiring valuable user data.[3, 4] Supporting Evidence & References:

3.8. Incident ID: 20250603-008 – Alleged sale of access to an unidentified Shop In USA

Affected Entity & Date: Unidentified Shop In USA, 2025-06-03 11:45:03Z. Category & Content: Initial Access. The threat actor claims to be selling WooCommerce/OpenCart Store with Full Payment Integration and Remote Backend Access. Network: openweb Threat Actor Profile: bonafire bonafire appears to be an initial access broker (IAB), specializing in compromising e-commerce platforms like WooCommerce/OpenCart to sell backend access. Their motivation is likely financial, as IABs profit by selling access to other cybercriminals who then conduct further malicious activities such as data theft or ransomware deployment.[2, 4, 5] Supporting Evidence & References:

3.9. Incident ID: 20250603-009 – Alleged database leak of Hyderabad Taxi

Affected Entity & Date: Hyderabad Taxi (India, Leisure & Travel), 2025-06-03 11:37:50Z. Category & Content: Data Breach. The threat actor claims to have leaked the data of Hyderabad Taxi. Network: openweb Threat Actor Profile: INDOHAXSEC INDOHAXSEC is an Indonesian hacktivist collective, officially established in early October 2024. They engage in cyberattacks such as distributed denial-of-service (DDoS), ransomware deployments, and hack-and-leak operations, often motivated by pro-Palestinian sentiments, religious ideology, and nationalistic agendas. They have been observed targeting entities perceived as supporting Israel and have formed alliances with groups like NoName057(16). Their toolkit includes custom malicious scripts and tools.[6, 7] Their targeting of an Indian entity aligns with their broader nationalistic and politically motivated agenda.[7] Supporting Evidence & References:

3.10. Incident ID: 20250603-010 – Alleged sale of RDweb access to General Paper Goods Co.

Affected Entity & Date: General Paper Goods Co. (GPG) (USA, Facilities Services), 2025-06-03 11:27:01Z. Category & Content: Initial Access. The threat actor claims to be selling the RDweb access to General Paper Goods Co. (GPG). Network: openweb Threat Actor Profile: gadji gadji appears to be an initial access broker, specializing in selling remote access to corporate networks, as evidenced by the sale of RDweb access. This type of access is highly sought after by other cybercriminals for various follow-on attacks, including data exfiltration, ransomware deployment, or further network compromise.[4, 8, 9] Supporting Evidence & References:

3.11. Incident ID: 20250603-011 – Alleged sale of access to an unindentified shop in Greece

Affected Entity & Date: Unidentified shop in Greece, 2025-06-03 11:08:54Z. Category & Content: Initial Access. The threat actor claims to be selling unauthorised full-panel access to a WordPress-based shop in Greece. Network: openweb Threat Actor Profile: maverickslab maverickslab operates as an initial access broker, focusing on e-commerce platforms, specifically WordPress-based shops. Their objective is likely financial gain through the sale of unauthorized administrative access, which can be used by buyers for various illicit activities such as payment card skimming, data theft, or website defacement.[4, 10, 11] Supporting Evidence & References:

3.12. Incident ID: 20250603-012 – Alleged leak of phone numbers from france

Affected Entity & Date: France, 2025-06-03 10:25:04Z. Category & Content: Data Leak. The threat actor claims to have leaked 57,000 phone numbers from France. Network: openweb Threat Actor Profile: courtika courtika appears to be a cybercriminal focused on collecting and leaking personal data, specifically phone numbers. Their motivation is likely financial, as leaked phone numbers can be used for various scams, phishing attempts, or sold to other malicious actors.[4, 12, 13] Supporting Evidence & References:

3.13. Incident ID: 20250603-013 – Alleged data breach of Onfido

Affected Entity & Date: Onfido (UK, Information Technology (IT) Services), 2025-06-03 09:52:40Z. Category & Content: Data Breach. The threat actor claims to have breached the data of Onfido. The leaked data includes ID document images (front and back), selfies, KYC workflow data, and liveness maps. It spans multiple countries and document types, with a total compressed size of about 70GB. Network: openweb Threat Actor Profile: dariusvirus1122 dariusvirus1122 appears to be a financially motivated cybercriminal specializing in large-scale data breaches, particularly targeting organizations that handle sensitive identity verification data. The nature and volume of the leaked data (70GB of ID documents, selfies, KYC data) suggest a high-value target and a significant potential for identity fraud.[3, 4] Supporting Evidence & References:

3.14. Incident ID: 20250603-014 – Alleged database leak of Prabharani Institute of Education

Affected Entity & Date: Prabharani Institute of Education (India, Education), 2025-06-03 09:42:43Z. Category & Content: Data Breach. The threat actor claims to have obtained the database of Prabharani Institute of Education. Network: openweb Threat Actor Profile: INDOHAXSEC INDOHAXSEC, an Indonesian hacktivist collective, continues to target entities in India, aligning with their nationalistic and politically motivated agenda. Their focus on an educational institution suggests an opportunistic approach to data acquisition, potentially for public exposure or to demonstrate capabilities.[6, 7] Supporting Evidence & References:

3.15. Incident ID: 20250603-015 – Alleged sale of SMS SPOOFER

Affected Entity & Date: N/A, 2025-06-03 09:01:55Z. Category & Content: Malware. The threat actor claims to be selling a sms spoofer. Network: openweb Threat Actor Profile: shadyrealone shadyrealone appears to be a cybercriminal involved in the development or distribution of malicious tools, specifically an SMS spoofer. Their motivation is likely financial, as such tools are sold to other cybercriminals to facilitate various scams, phishing, or social engineering attacks.[4, 14, 15] Supporting Evidence & References:

3.16. Incident ID: 20250603-016 – Team 1722 claims to target the website of Marie Louis

Affected Entity & Date: Marie Louis (Egypt, Fashion & Apparel), 2025-06-03 08:23:27Z. Category & Content: Defacement. The group claims to have defaced the website of Marie Louis. Network: telegram Threat Actor Profile: Team 1722 Team 1722 appears to be a hacktivist group, as evidenced by their website defacement activity. Their motivation is likely ideological or political, aiming to disrupt or send a message by altering public-facing websites.[16, 17, 18] Supporting Evidence & References:

3.17. Incident ID: 20250603-017 – Alleged databreach of GPS Tech Co., Ltd.

Affected Entity & Date: GPS Tech Co., Ltd. (Thailand, Automotive), 2025-06-03 08:11:35Z. Category & Content: Data Breach. The group claims to have breached 56GB of data from the database of GPS Tech Co., Ltd. Network: telegram Threat Actor Profile: NDT SEC NDT SEC appears to be a cybercriminal group specializing in large-scale data breaches, as indicated by the 56GB data exfiltration from an automotive company. Their activities align with financially motivated cybercrime, where large datasets are acquired for sale on underground markets.[3, 19] Supporting Evidence & References:

3.18. Incident ID: 20250603-018 – Alleged database sale of Lex Logos Romania

Affected Entity & Date: Lex Logos Romania SRL (Romania, Legal Services), 2025-06-03 07:28:54Z. Category & Content: Data Breach. A threat actor claims to be selling 68 GB of data allegedly from Lex Logos Romania SRL, a translation and legal documentation firm. The compromised data reportedly includes passports, ID cards, academic transcripts, legal certificates, medical records, and financial transactions from 2014 to 2024, in PDF, DOCX, and JPEG formats, across multiple languages. Network: openweb Threat Actor Profile: Sentap Sentap appears to be a financially motivated cybercriminal specializing in large-scale data breaches and the subsequent sale of highly sensitive personal and legal documentation. The extensive nature of the compromised data (68GB, including passports, medical records, financial transactions) indicates a high-value target and a significant risk for identity theft and fraud.[3, 4] Supporting Evidence & References:

3.19. Incident ID: 20250603-019 – Alleged data leak of Indian citizens

Affected Entity & Date: India, 2025-06-03 07:24:39Z. Category & Content: Data Leak. The threat actor claims to have leaked the data of Indian citizens. Network: openweb Threat Actor Profile: hagilo2748 hagilo2748 appears to be a cybercriminal focused on leaking broad datasets of citizens, likely for financial gain through sale to other malicious actors. The lack of specific victim organization suggests a wide-ranging data acquisition method.[3, 4] Supporting Evidence & References:

3.20. Incident ID: 20250603-020 – Alleged database leak of French citizens

Affected Entity & Date: France, 2025-06-03 07:12:51Z. Category & Content: Data Leak. The threat actor claims to have leaked a database of French citizens. Network: openweb Threat Actor Profile: decojo4605 decojo4605 appears to be a cybercriminal involved in the large-scale leakage of citizen databases. Similar to other broad data leaks, the motivation is likely financial, with the data potentially being sold for various illicit purposes such as identity fraud or targeted scams.[3, 4] Supporting Evidence & References:

3.21. Incident ID: 20250603-021 – Alleged Database leak of Mahkamah Agung Republik Indonesia

Affected Entity & Date: Mahkamah Agung Republik Indonesia (Indonesia, Legal Services), 2025-06-03 06:20:11Z. Category & Content: Data Breach. A threat actor known as Digital Ghost has leaked data from Mahkamah Agung (Indonesia’s Supreme Court), exposing personal information of individuals from various institutions including courts, universities, and international organizations. The leaked records contain names, job titles, email addresses, phone numbers, organizational affiliations, and timestamps posing risks to privacy and the security of legal and academic personnel. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost is a highly organized hacktivist group with ties to the Anonymous collective, known for shifting from ideological hacktivism to financially motivated cyber mafia activities. They share exclusive content, including leaks and tutorials, on their premium Telegram channel. Historically, they participated in hacktivist initiatives like #opisis against ISIS and are known for DDoS attacks, system intrusion, webpage defacement, and leaking stolen information. Their operations demonstrate a high level of cooperation and organization.[20] Their targeting of the Indonesian Supreme Court aligns with their potential shift towards financially motivated operations or continued hacktivist objectives against government entities. Supporting Evidence & References:

3.22. Incident ID: 20250603-022 – Alleged leak of collection of documents in Cyrillic language

Affected Entity & Date: N/A, 2025-06-03 05:46:15Z. Category & Content: Data Leak. The threat actor claims to have leaked 6.6GB collection of Cyrillic-language documents. There is no detailed description of the content, source, or sensitivity of the data. Network: openweb Threat Actor Profile: Matteo Matteo appears to be a cybercriminal involved in the leakage of large document collections. While the specific motivation is unclear without content details, such leaks are typically financially driven, with the data potentially being sold to interested parties.[3, 4] Supporting Evidence & References:

3.23. Incident ID: 20250603-023 – Alleged data breach of Dewan Perwakilan Rakyat Republik Indonesia

Affected Entity & Date: Dewan Perwakilan Rakyat Republik Indonesia (Indonesia, Government & Public Sector), 2025-06-03 05:45:52Z. Category & Content: Data Breach. The threat actor claims to have breached the database of Dewan Perwakilan Rakyat Republik Indonesia. The compromised data consists of name, religion, date of birth, etc. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost, a group known for its hacktivist origins and recent shift towards financially motivated activities, continues to target high-profile Indonesian government entities. The breach of the Indonesian House of Representatives’ database, exposing personal details, aligns with their capability for system intrusion and data leakage.[20] Supporting Evidence & References:

3.24. Incident ID: 20250603-024 – Alleged data leak of Unidentified China Natural Gas Company

Affected Entity & Date: China, Oil & Gas, 2025-06-03 05:40:42Z. Category & Content: Data Leak. The threat actor claims to be selling 15 million leaked user records from an unidentified China Natural Gas Company, including names, mobile numbers, ID card numbers, addresses, birthdates, and location data. Network: openweb Threat Actor Profile: heiwukoong heiwukoong appears to be a financially motivated cybercriminal specializing in large-scale data leaks from critical infrastructure sectors. The sale of 15 million records from a natural gas company, including highly sensitive personal and location data, indicates a high-value target and significant potential for financial exploitation.[3, 4] Supporting Evidence & References:

3.25. Incident ID: 20250603-025 – Alleged sale of Unauthorized access to Smartfren Internal SIM Registration Panel

Affected Entity & Date: PT Smartfren Telecom Tbk (Indonesia, Network & Telecommunications), 2025-06-03 05:15:08Z. Category & Content: Initial Access. Threat actor Captainfen is selling access to Smartfren Telecom’s internal SIM registration panel, exposing sensitive customer and operational data, including personal IDs, financial details, and geolocation information, with over 220 million transactions recorded. Network: openweb Threat Actor Profile: Captainfen Captainfen operates as an initial access broker, specializing in compromising telecommunications infrastructure to sell highly privileged access. Their focus on internal SIM registration panels, exposing vast amounts of sensitive customer and operational data, indicates a financially motivated actor targeting high-value access for resale to other cybercriminals.[4, 10, 21] Supporting Evidence & References:

3.26. Incident ID: 20250603-026 – Alleged sale of unauthorized access to Telkomsel

Affected Entity & Date: Telkomsel (Indonesia, Network & Telecommunications), 2025-06-03 05:15:04Z. Category & Content: Initial Access. The threat actor claims to have unauthorized access to the Telkomsel center panel. The access allows Viewing, activating, suspending, or testing the sim cards and contains sim data, tracking, etc. Network: openweb Threat Actor Profile: Captainfen Captainfen’s continued targeting of Indonesian telecommunications providers, specifically Telkomsel, reinforces their role as a specialized initial access broker. The ability to control SIM cards and access tracking data from a central panel represents extremely high-value access for various malicious activities, from surveillance to fraud.[4, 10, 21] Supporting Evidence & References:

3.27. Incident ID: 20250603-027 – Alleged sale of unauthorized access of 3 Doctors Know you

Affected Entity & Date: 3 Doctors Know You (Thailand, Hospital & Health Care), 2025-06-03 05:15:00Z. Category & Content: Initial Access. The group claims to have unauthorized access to 3 Doctors Know You. The Operating Systems had taken over and more than 2500 doctor’s accounts have been hacked. Network: telegram Threat Actor Profile: NDT SEC NDT SEC appears to be a cybercriminal group engaged in acquiring and selling unauthorized access, particularly to healthcare systems. The compromise of over 2500 doctor accounts in a Thai healthcare entity suggests a financially motivated operation, as healthcare data and access are valuable on underground markets.[3, 19] Supporting Evidence & References:

3.28. Incident ID: 20250603-028 – Alleged Data Leak of Indonesian Police Database

Affected Entity & Date: State Police of the Republic of Indonesia (Indonesia, Government Administration), 2025-06-03 04:48:10Z. Category & Content: Data Breach. The threat actor claims to have leaked data from the State Police of the Republic of Indonesia, exposing names, ranks, roles, and phone numbers of Indonesian police personnel. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost continues its pattern of targeting sensitive Indonesian government databases. The leakage of police personnel data, including names, ranks, and phone numbers, could be motivated by hacktivism, aiming to undermine state authority, or by financial gain through the sale of highly sensitive information.[20] Supporting Evidence & References:

3.29. Incident ID: 20250603-029 – Alleged data breach of Directorate General of Taxation

Affected Entity & Date: Directorate General of Taxation (Indonesia, Government Administration), 2025-06-03 04:45:51Z. Category & Content: Data Breach. The threat actor claims to have breached database of Indonesia’s NPWP/DJP (taxpayer database). The leaked data includes highly sensitive personal and financial information such as National ID numbers (NIK), Taxpayer Numbers (NPWP), full names, residential addresses, birth details, contact information, taxpayer status, and business classifications. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost’s breach of Indonesia’s taxpayer database represents a significant compromise of national sensitive data. The exposure of NIK, NPWP, and extensive personal and financial information aligns with their capabilities for large-scale data exfiltration and could serve both financial and ideological motivations.[20] Supporting Evidence & References:

3.30. Incident ID: 20250603-030 – Alleged data breach of Cassino88

Affected Entity & Date: Cassino88 (Indonesia, Gambling & Casinos), 2025-06-03 04:35:42Z. Category & Content: Data Breach. The threat actor claims to be responsible for a data breach involving Cassino 88, an online slot or gambling platform. The leaked a dataset that allegedly contains personally identifiable information (PII) of numerous global users. The exposed data includes full names, physical addresses, cities, states, ZIP/postal codes, countries, email addresses, phone numbers, and individual deposit amounts. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost’s alleged breach of an online gambling platform, exposing PII and deposit amounts of global users, further supports their shift towards financially motivated cybercrime. Gambling platforms are lucrative targets due to the sensitive financial and personal data they hold.[20] Supporting Evidence & References:

3.31. Incident ID: 20250603-031 – Alleged data breach of Buffalo city Metropolitan Municipality

Affected Entity & Date: Buffalo City Metropolitan Municipality (South Africa, Government Administration), 2025-06-03 04:08:58Z. Category & Content: Data Breach. The group claims to have breached the data of Buffalo city Metropolitan Municipality in South Africa. Network: telegram Threat Actor Profile: CyberVolk Arcanum CyberVolk Arcanum appears to be a cybercriminal or hacktivist group targeting government entities, as evidenced by the data breach of a South African municipality. Their motivation could be financial gain through data sale or ideological, aiming to disrupt government operations.[3, 18] Supporting Evidence & References:

3.32. Incident ID: 20250603-032 – Alleged data breach of Bank Syariah Indonesia

Affected Entity & Date: Bank Syariah Indonesia (Indonesia, Banking & Mortgage), 2025-06-03 03:19:13Z. Category & Content: Data Breach. The threat actor claims to have breached the data of Bank Syariah Indonesia database. The compromised data consists of name, email, address, phone number, etc. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost’s alleged breach of a major Indonesian bank’s database, exposing personal and contact information, further solidifies their engagement in financially motivated cybercrime. Financial institutions are prime targets for data theft due to the high value of customer information.[20] Supporting Evidence & References:

3.33. Incident ID: 20250603-033 – Alleged data breach of Majelis Permusyawaratan Rakyat Republik Indonesia (MPR RI)

Affected Entity & Date: Majelis Permusyawaratan Rakyat Republik Indonesia (MPR RI) (Indonesia, Government Administration), 2025-06-03 03:01:04Z. Category & Content: Data Breach. The threat actor claims to be behind a data breach targeting the official website of the Majelis Permusyawaratan Rakyat Republik Indonesia (MPR RI), accessible at mpri.go.id. The leaked database containing detailed personal information of Indonesian legislative members for the 2019–2024 term. The data includes names, membership numbers, birth details, education, political affiliations (factions), provinces, positions, and status of members, along with timestamps of record creation and updates. Network: openweb Threat Actor Profile: DigitalGhost DigitalGhost’s consistent targeting of Indonesian government and public sector entities, including the MPR RI, indicates a strategic focus on compromising state data. The detailed personal information of legislative members is highly sensitive and could be used for various purposes, from espionage to targeted social engineering.[20] Supporting Evidence & References:

3.34. Incident ID: 20250603-034 – Alleged database leak of Verified Casino Users from Asia

Affected Entity & Date: Verified Casino Users from Asia (Gambling & Casinos), 2025-06-03 02:38:24Z. Category & Content: Data Leak. A threat actor claims to has leaked a database containing information on 3 million verified users of various online casinos targeting Asian markets, primarily in the Philippines (PH), Thailand (TH), and Bangladesh (BD). Network: openweb Threat Actor Profile: baddie baddie appears to be a financially motivated cybercriminal specializing in large-scale data leaks from online gambling platforms. The compromise of 3 million verified casino users from multiple Asian countries highlights the lucrative nature of this sector for data theft, with exposed PII posing significant risks for fraud and targeted attacks.[4, 18] Supporting Evidence & References:

3.35. Incident ID: 20250603-035 – Alleged Data Leak of Pardos Chicken

Affected Entity & Date: Pardos Chicken (Peru, Food & Beverages), 2025-06-03 02:29:12Z. Category & Content: Data Breach. The threat actor claims to have extracted 2.2 million customer records from Pardos Chicken due to a vulnerability in their website’s authorization checks. Network: openweb Threat Actor Profile: abzerocool abzerocool appears to be a financially motivated cybercriminal, exploiting website vulnerabilities to extract large volumes of customer data. The compromise of 2.2 million customer records from a food and beverage company demonstrates an opportunistic approach to data theft, likely for sale on underground markets.[3, 4] Supporting Evidence & References:

3.36. Incident ID: 20250603-036 – Alleged data breach of Claro

Affected Entity & Date: Claro (Peru, Network & Telecommunications), 2025-06-03 02:28:38Z. Category & Content: Data Breach. A threat actor claims to have breached database containing over 15 million Claro customer records including names, ID numbers, emails, billing details, and phone numbers. Network: openweb Threat Actor Profile: Dedale Dedale appears to be a financially motivated cybercriminal specializing in large-scale data breaches from telecommunications providers. The compromise of over 15 million customer records from Claro, including extensive personal and billing details, highlights the high value of such data for various illicit activities.[4, 22, 23] Supporting Evidence & References:

3.37. Incident ID: 20250603-037 – Alleged Database leak of FSTE Université Moulay Ismaïl

Affected Entity & Date: FSTE Université Moulay Ismaïl (Morocco, Research Industry), 2025-06-03 02:24:06Z. Category & Content: Data Breach. A threat actor has leaked the database of Faculté des Sciences et Techniques – Université Moulay Ismaïl (FSTE UMI), exposing over 650,000 records in a 75.6 MB SQL file dated 2021. The breach includes sensitive user information such as names, emails, phone numbers, and hashed passwords, as well as application data, form structures, uploaded file metadata, program details, and password reset tokens—posing serious risks of identity theft, academic fraud, and unauthorized access to institutional systems. Network: openweb Threat Actor Profile: r3i r3i appears to be a cybercriminal or hacktivist group focused on breaching educational and research institutions to leak sensitive databases. The exposure of 650,000 records, including hashed passwords and personal information, suggests a motivation for either financial gain or to demonstrate capabilities and cause disruption.[4, 24, 25] Supporting Evidence & References:

3.38. Incident ID: 20250603-038 – Alleged data breach of Puntadewa Surabaya

Affected Entity & Date: Puntadewa Surabaya (Indonesia, Government Administration), 2025-06-03 01:54:32Z. Category & Content: Data Breach. A threat actor claims to have breached database from PUNTADEWA Surabaya, Indonesia. The breach includes sensitive personal information such as National Identification Numbers (NIK), full names, addresses, neighborhood details (RT/RW), sub-districts (Kelurahan), districts (Kecamatan), and family card numbers (NO KK). Network: openweb Threat Actor Profile: VirXploit24 VirXploit24 appears to be a cybercriminal or hacktivist group targeting Indonesian government administration entities. The breach of a local government database, exposing highly sensitive personal identification and family data, suggests motivations ranging from financial exploitation to ideological disruption.[3, 18] Supporting Evidence & References:

3.39. Incident ID: 20250603-039 – Alleged Data breach of Nigerian Banking Portals

Affected Entity & Date: Central Bank of Nigeria (Nigeria, Banking & Mortgage), 2025-06-03 01:42:53Z. Category & Content: Data Breach. The threat actor claims unauthorized access to the databases of two Nigerian financial institutions, including the Central Bank of Nigeria (cbn.gov.ng) and the Chartered Institute of Bankers of Nigeria (portal.cibng.org). Network: openweb Threat Actor Profile: kevin_Vladimir kevin_Vladimir appears to be a cybercriminal specializing in gaining unauthorized access to financial institutions, including central banks. Their targeting of critical banking portals in Nigeria suggests a high-value objective, likely financial gain through the sale of access or data, or potentially state-sponsored espionage given the nature of the targets.[4, 26] Supporting Evidence & References:

3.40. Incident ID: 20250603-040 – Alleged Data Sale of Unauthorized Access to Swamy Abedhanandha Vidhyashram CBSE School

Affected Entity & Date: Swamy Abedhanandha Vidhyashram CBSE School (India, Education), 2025-06-03 01:01:41Z. Category & Content: Initial Access. The threat actor claims to have unauthorized access to the admin panel of the SAV C.B.S.E. School website. Network: telegram Threat Actor Profile: BABAYO EROR SYSTEM BABAYO EROR SYSTEM appears to be a cybercriminal group focused on gaining and selling unauthorized access to organizational systems, particularly administrative panels of educational institutions. Their motivation is likely financial, as admin access can be sold for various malicious purposes, including data manipulation or further compromise.[4, 18] Supporting Evidence & References:

3.41. Incident ID: 20250603-041 – Alleged sale of 0-day vulnerability affecting TerraMaster NAS

Affected Entity & Date: TerraMaster (China, Computer & Network Security), 2025-06-03 00:54:00Z. Category & Content: Vulnerability. The Threat actor claims to be selling a pre-authentication RCE exploit for TerraMaster NAS devices running TOS versions 4 and 5. The exploit requires no permissions or user interaction and grants root access. Network: openweb Threat Actor Profile: skart7 skart7 appears to be a highly skilled cybercriminal specializing in the discovery and sale of zero-day vulnerabilities. The sale of a pre-authentication RCE exploit for NAS devices, granting root access without user interaction, indicates a high level of technical proficiency and a focus on lucrative vulnerability markets.[4, 9, 27] Supporting Evidence & References:

3.42. Incident ID: 20250603-042 – Alleged Sale of Zero-Day Vulnerability Enabling Full Access to Tunisian Government Portals

Affected Entity & Date: Tunisia, Government Administration, 2025-06-03 00:34:27Z. Category & Content: Vulnerability. The threat actor claims to be selling a zero-day vulnerability (0day) affecting a critical Tunisian government system. The exploit allegedly provides access to a wide range of E-Government portals, including sensitive systems such as the Tunisian Tax Authority (DGI), National Social Security Fund (CNSS), National Health Insurance Fund (CNAM), Tunisian Post, banking services, educational sectors, and some military sectors. Network: openweb Threat Actor Profile: DedSec DedSec appears to be a highly skilled threat actor specializing in discovering and monetizing critical zero-day vulnerabilities, particularly those affecting government infrastructure. The sale of an exploit providing full access to a wide range of Tunisian E-Government portals, including tax, social security, banking, and military sectors, suggests a significant financial motivation or potentially state-sponsored objectives.[4, 20, 28] Supporting Evidence & References:

The analysis of today’s incidents reveals several overarching trends shaping the current cyber threat landscape.

4.1. Pervasive Data Leaks and Breaches

The overwhelming majority of incidents reported are data leaks and breaches, indicating that data exfiltration remains a primary objective for cybercriminals. These incidents span various sectors, including financial services (Coinbase, Bank Syariah Indonesia), education (SMK NEGERI 2 KASIHAN, Prabharani Institute, FSTE Université Moulay Ismaïl, SAV C.B.S.E. School), government administration (DISNAKER KOTA DEPOK, Pringsewu Regency, Mahkamah Agung, Dewan Perwakilan Rakyat, Indonesian Police, Directorate General of Taxation, Buffalo City Municipality, MPR RI, Puntadewa Surabaya), and even niche industries like events (GreenVelope) and food & beverages (Pardos Chicken). The types of data compromised are highly sensitive, ranging from phone numbers and emails to national IDs, financial details, and even ID document images, posing severe risks for identity theft and fraud.

4.2. Focus on Critical Infrastructure and Government Entities

A significant portion of the reported incidents targets government administration, telecommunications, and financial services, particularly in Indonesia. This includes breaches of the Indonesian Supreme Court, House of Representatives, State Police, Directorate General of Taxation, and major banks and telecom providers. This concentration suggests that these sectors are high-value targets for both financially motivated actors seeking sensitive data and potentially hacktivist groups aiming to disrupt or expose state operations. The compromise of such entities can have far-reaching consequences, affecting national security, public trust, and economic stability.

4.3. Active Initial Access Broker Market

Several incidents involve the sale of unauthorized access to compromised systems (e.g., WooCommerce/OpenCart stores, RDweb access, WordPress admin panels, SIM registration panels). This highlights a thriving underground market for initial access, where threat actors specialize in gaining entry to networks and then selling that access to other cybercriminals. This “access-as-a-service” model lowers the barrier for subsequent, more damaging attacks, such as ransomware deployment or large-scale data exfiltration.

4.4. Emergence and Monetization of Zero-Day Vulnerabilities

The alleged sale of zero-day vulnerabilities affecting TerraMaster NAS devices and critical Tunisian government systems indicates a sophisticated segment of the cybercriminal ecosystem focused on discovering and monetizing high-impact exploits. These vulnerabilities, which require no user interaction and grant root access, pose a severe threat as they can be used to compromise systems without prior knowledge or patches, leading to widespread and rapid exploitation.

4.5. Geographic Concentration

Indonesia appears to be a particularly targeted country in this 24-hour period, with numerous data breaches affecting its government, financial, and telecommunications sectors. India, France, Peru, and Thailand also feature prominently in the reported incidents. This geographic focus could be due to specific vulnerabilities, perceived lower security postures, or strategic interests of the threat actors involved.

5. Recommendations & Mitigation Strategies

Given the dynamic and aggressive nature of the current cyber threat landscape, a multi-layered and proactive approach to cybersecurity is essential.

5.1. General Cybersecurity Hygiene

  • Implement Multi-Factor Authentication (MFA): Essential for preventing credential theft, which serves as a common initial access vector for many threat groups.
  • Regular Patch Management: Promptly applying security updates to operating systems, applications, and network devices is crucial for closing vulnerabilities, especially those exploited for initial access or data breaches.
  • Robust Backup and Recovery Strategy: Organizations should implement immutable, offline backups to mitigate the impact of data breaches and ensure business continuity even after a compromise.
  • Employee Cybersecurity Training: Continuous education for employees on identifying and reporting phishing attempts, suspicious links, and social engineering tactics is vital, as human error remains a primary vector for many attacks.
  • Network Segmentation: Isolating critical systems and sensitive data through network segmentation limits lateral movement within a compromised network and significantly reduces the blast radius of attacks.

5.2. Enhanced Data Protection Measures

  • Data Encryption: Encrypt sensitive data both in transit and at rest to protect it even if exfiltrated.
  • Data Loss Prevention (DLP) Solutions: Deploy DLP tools to monitor and prevent unauthorized exfiltration of sensitive information.
  • Regular Data Audits: Conduct frequent audits of databases and data repositories to identify and remediate unauthorized access or unusual activity.
  • Strong Access Controls: Implement the principle of least privilege, ensuring users and systems only have access to the data necessary for their functions.

5.3. Countering Initial Access Brokers and Vulnerability Exploitation

  • Vulnerability Management Program: Establish a comprehensive program for identifying, assessing, and remediating vulnerabilities across all assets, including third-party software and web applications.
  • Web Application Firewalls (WAFs): Deploy WAFs to protect web-facing applications from common exploits and authorization bypasses.
  • Threat Intelligence Integration: Integrate high-fidelity threat intelligence feeds to stay informed about new vulnerabilities, exploits, and the TTPs of initial access brokers.
  • Proactive Threat Hunting: Actively search for signs of compromise within networks, especially for unauthorized access attempts or unusual activity on administrative panels.

5.4. Critical Infrastructure and Government Specific Recommendations

  • Enhanced Monitoring: Implement advanced monitoring solutions for critical systems and networks, including those in OT/ICS environments, to detect anomalous behavior indicative of compromise.
  • Incident Response Planning: Develop, regularly test, and update comprehensive incident response plans tailored for data breaches and operational disruptions in critical sectors.
  • Public-Private Partnerships: Foster collaboration and information sharing between government agencies and private sector entities to enhance collective defense against sophisticated threats.
  • Supply Chain Security: Implement rigorous security assessments for third-party vendors and software, as supply chain vulnerabilities are frequently exploited to gain initial access to critical systems.

6. Conclusion

The cybersecurity landscape, as evidenced by the incidents of June 3, 2025, is characterized by a persistent and evolving threat from both sophisticated cybercriminals and hacktivist groups. The analysis highlights a concerning trend of widespread data leaks and breaches, with a particular focus on critical infrastructure and government entities, especially in Indonesia. The active market for initial access and zero-day vulnerabilities further exacerbates these risks, enabling more damaging and widespread attacks.

Organizations must continuously adapt their security postures, focusing on resilience, intelligence-driven defense, and proactive measures rather than merely reactive ones. The interconnectedness of modern systems means that a compromise in one area can have cascading effects across an entire enterprise or even a national infrastructure.

Therefore, ongoing vigilance, collaborative efforts between public and private sectors, and sustained investment in advanced cybersecurity capabilities are paramount. These measures are essential not only to protect against evolving threats but also to ensure operational continuity and national security in an increasingly interconnected and vulnerable digital world.

Related Posts