{
    "success": true,
    "data": {
        "id": 1694076,
        "msgid": "cross-border-phishing-tools-syndicate-dismantled-perpetrators-a-romantic-couple-1776858656",
        "date": "2026-04-22 18:03:37",
        "title": "Cross-Border Phishing Tools Syndicate Dismantled, Perpetrators a Romantic Couple",
        "author": "",
        "source": "DETIK",
        "tags": "",
        "topic": "Legal",
        "summary": "Indonesian police, in collaboration with the FBI, have dismantled an international syndicate run by a couple in Kupang, East Nusa Tenggara, who produced and sold phishing tools, amassing profits of Rp 25 billion while causing an estimated Rp 350 billion in damages to over 34,000 victims worldwide, including nine Indonesian companies. The male suspect, a self-taught script developer, operated websites to market the illegal tools since 2018, while his partner managed cryptocurrency finances. Both face severe penalties under cybercrime and money laundering laws, highlighting the global reach of cyber threats originating from Indonesia.",
        "content": "<p>The Directorate of Cyber Crime (Dittipidsiber) of the National Police\nCriminal Investigation Agency has dismantled a network providing hacking\ndevices or phishing tools. This revelation was achieved in cooperation\nwith the United States Federal Bureau of Investigation (FBI).<\/p>\n<p>Dittipidsiber\u2019s Brigadier General Himawan Bayu Aji stated that his\nteam successfully arrested two perpetrators involved in this illegal\npractice. The pair operated across borders.<\/p>\n<p>\u201cInvestigators from the Directorate of Cyber of the National Police\nCriminal Investigation Agency, along with the NTT Provincial Police\u2019s\nCriminal Investigation Directorate, successfully tracked and secured two\nperpetrators in Kupang City, NTT,\u201d said Himawan Bayu Aji during a press\nconference at the National Police Criminal Investigation Agency in South\nJakarta on Wednesday (22\/4\/2026).<\/p>\n<p>The two suspects are GWL (24), a male high school multimedia graduate\nwho was the mastermind behind creating illegal scripts autodidactically,\nand his girlfriend FYT (25), who handled the finances from the\ncrimes.<\/p>\n<p>Himawan explained that GWL had been independently producing and\ndeveloping phishing tools since 2018. He operated several websites, such\nas w3ll.store, well.store, and well.shop, to market the tools.<\/p>\n<p>\u201cSuspect GWL acted as the main perpetrator who produced and sold\nindependently since 2018. His background is a multimedia vocational high\nschool graduate, and he acquired script-making skills autodidactically,\u201d\nHimawan clarified.<\/p>\n<p>Meanwhile, his girlfriend FYT provided fund storage through\ncryptocurrency wallets. FYT was responsible for converting\ncryptocurrency payments into rupiah and withdrawing them via personal\nbank accounts.<\/p>\n<p>\u201cThe suspect is GWL\u2019s girlfriend since 2016 and assisted the suspect\nin managing sales finances,\u201d he said.<\/p>\n<p>Himawan revealed that in running their illegal business, the two\nsuspects used virtual private server (VPS) services located abroad.<\/p>\n<p>\u201cThe suspects also conducted automatic sales monitoring and provided\ntechnical support services to script buyers experiencing issues,\u201d he\nexplained.<\/p>\n<p>Thousands Become Victims<\/p>\n<p>Based on coordination with the FBI, Himawan continued, it was found\nthat the couple\u2019s illegal activities had caused massive victims. It was\nidentified that there were 2,440 script buyers spread across various\ncountries.<\/p>\n<p>\u201cThere were 2,440 buyers who transacted from 2019 to 2024 through VPS\ninfrastructure in Dubai and Moldova. All transactions were confirmed\nusing cryptocurrency assets recorded in purchase history,\u201d Himawan\nstated.<\/p>\n<p>Data was also obtained on approximately 34,000 identified victims\nfrom January 2023 to April 2024. Of that number, 17,000 victims or about\n50 percent were confirmed to have experienced hacking.<\/p>\n<p>\u201cFrom analysis of 157 victims, 53 percent are from the United States,\nwhile the remaining 47 percent are from various countries worldwide,\u201d\nHimawan explained.<\/p>\n<p>\u201cWithin that group, nine Indonesian company entities were also\nidentified as victims,\u201d he detailed.<\/p>\n<p>The two suspects had reaped profits of up to Rp 25 billion since\ncarrying out their illegal actions. Meanwhile, the losses inflicted on\nvictims from the use of scripts sold by the suspects are estimated at\nUSD 20 million or approximately Rp 350 billion.<\/p>\n<p>From the two perpetrators, investigators have seized assets worth Rp\n4.5 billion strongly suspected to be proceeds of crime. The evidence\nsecured includes cars, motorcycles, land and buildings (SHM), computers,\ndozens of ATM cards, and cryptocurrency wallets.<\/p>\n<p>For their actions, suspect GWL is charged under Article 51 paragraph\n(1) in conjunction with Article 35 and\/or Article 50 in conjunction with\nArticle 34 paragraph (1) of Law Number 1 of 2024 on the Second Amendment\nto Law Number 11 of 2008 on Electronic Information and Transactions (UU\nITE), with a maximum penalty of 15 years imprisonment and a fine of Rp\n10 billion.<\/p>\n<p>Meanwhile, FYT is charged under Article 607 paragraph (1) letter a or\nletter c of Law Number 1 of 2023 on the Criminal Code (TPPU), with a\npenalty of 15 years imprisonment and a fine of Rp 5 billion.<\/p>",
        "url": "https:\/\/jawawa.id\/newsitem\/cross-border-phishing-tools-syndicate-dismantled-perpetrators-a-romantic-couple-1776858656",
        "image": ""
    },
    "sponsor": "Okusi Associates",
    "sponsor_url": "https:\/\/okusiassociates.com"
}