132 organisations in Indonesia have been listed on ransomware leak sites,
ranking #27 worldwide. Updated .
Victims
132
0.6% of global total
Global rank
#27
of 180 countries
Active groups
46
Most: Nova
Sectors
20
Most: Financial Services
ThreatAI analysis
Compiled from this database and the ransomware.live profiles of the groups active in Indonesia. Figures are computed from the tracked records, not inferred.
Indonesia sees 132 recorded ransomware attacks globally ranking it 27th; its most active groups, Nova, Thegentlemen, and Babuk2, target sectors like Financial Services and Agriculture and Food Production.
Indonesia in the global picture
Indonesia accounts for 132 of the ransomware disclosures tracked here, ranking #27 worldwide and making up 0.6% of the global total. The sectors listed most often are Financial Services, Agriculture and Food Production, Energy.
Who is most active in Indonesia
Nova — 14 victims in Indonesia. Nova (formerly RALord) is a ransomware-as-a-service (RaaS) group that encrypts victims’files and uses double-extortion tactics to pressure organizations into paying for decryption and data non-disclosure. Thegentlemen — 9 victims in Indonesia. Babuk2 — 9 victims in Indonesia. Babuk Locker 2.0, also known as Bjorka or SkyWave, after failing to make any profit from selling public databases on forums, decided to impersonate Babuk Ransomware group.
Ransomware threat profile: Indonesia
Indonesia ranks #27 worldwide for ransomware disclosures,
with 132 victims in this database — 0.6% of the global total.
The groups listing the most organisations here are
Nova, Thegentlemen and Babuk2.
The most frequently listed industries in Indonesia are Financial Services, Agriculture and Food Production, Energy.
Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.
The volume reflects Indonesia's integration into the global economy and the reach of ransomware operations that target organisations of every size.
Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.
How many ransomware attacks have occurred in Indonesia?
Indonesia has recorded 132 ransomware victim disclosures in this database, ranking #27 globally. This represents 0.6% of all tracked ransomware attacks worldwide.
Which ransomware groups target Indonesia?
The ransomware groups most active in Indonesia are Nova, Thegentlemen, Babuk2, Coinbasecartel. These groups collectively account for the majority of victim disclosures attributed to Indonesia.
Which industries are most targeted by ransomware in Indonesia?
In Indonesia, the most frequently targeted sectors are Financial Services, Agriculture and Food Production, Energy. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Indonesia rank globally for ransomware attacks?
Indonesia ranks #27 globally for ransomware attacks with 132 victim disclosures, representing 0.6% of the worldwide total of 23,585 tracked victims.
How can organisations in Indonesia protect against ransomware?
Organisations in Indonesia should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Indonesia is also recommended.
This site uses cookies for analytics and advertising.
Cookie policy
CTI Digest
Every Monday, the 5 threats SOC teams can't afford to miss — with analyst commentary.
