Man Arrested for Malware Attacks on Gov’t Websites

Jakarta. A Yogyakarta man has been arrested for allegedly attacking more than 1,000 websites -- many of them belong to the government -- using malicious software called ransomware for his personal gains, police said on Tuesday.

The 24-year-old suspect, identified by initials A.D.C., has attacked websites belonging to judicial institutions, regional department offices, state agencies and universities, National Police spokesman Insp. Gen. Argo Yuwono said in Jakarta.

Investigation revealed that the suspect has hacked the Supreme Court website, Argo said without elaborating.

The suspect sent phishing emails to spread ransomware, which blocked users from accessing their websites. He then extorted money from the victims, amounting to between Rp 2 million and Rp 5 million ($346), Argo said.

“Since 1,309 websites have been hacked, he must have collected billions of rupiah," the officer said.

The suspect has also targeted websites in Australia, Portugal, the UK and the US, Argo said.

He added the suspect was arrested in the Yogyakarta town of Sleman five days ago and the case is now being handled by the National Police cyber crime unit.

Police charge him under the Electronic Information and Transaction Law (ITE) that carries a maximum sentence of 12 years in jail and a fine of up to Rp 1 billion.

It’s not the first time police arrested a hacker who hid in Sleman.

In October last year, a 21-year-old man was arrested for ransomware attacks to collect Bitcoins in ransom. The suspect had reportedly been acting alone since 2014 and collected 300 Bitcoins, or equivalent to around $2.25 million.

The case was uncovered over a tipoff that the suspect had hacked the computer system of a company based in San Antonio, Texas.

He had sent emails containing hyperlinks that directed unsuspecting recipients to his webmail server, which would then install ransomware on recipients' computer systems and prevent them from accessing their data. 

In the case involving the US company, the suspect threatened to delete its data if it failed to pay the ransom within three days, police said at that time.