Bareskrim Dismantles Kratos Phishing Network, Thousands of Victims Across Multiple Countries
The Directorate of Cyber Crime (Dittipidsiber) of the Indonesian National Police’s Criminal Investigation Agency (Bareskrim) has uncovered the development and sale of a phishing-as-a-service (PhaaS) platform known as Kratos. The service is suspected of being used to launch phishing attacks against victims in several countries.
During the operation, police arrested a 25-year-old man with the initials MI in Pontianak, West Kalimantan, on 11 July 2026. MI is alleged to be the developer and manager of Kratos, providing phishing tools and technical support services to its users.
Brigadier General Adex Yudiswan, Director of Cyber Crime at Bareskrim, stated that the investigation into Kratos stemmed from the development of a previous phishing case handled by the unit, including the previously uncovered W3LL Store case. “From the development of the W3LL Store case, investigators discovered another platform providing phishing tools. This finding was then investigated further, leading to Kratos and its developer in Indonesia,” Brigadier General Adex Yudiswan said in a statement on Friday (24/7/2026).
He explained that investigators subsequently conducted cyber investigations, examined the tools with information technology experts, and traced the digital infrastructure, cryptocurrency transactions, and fund flows. The investigation led to MI, who is suspected of developing and selling phishing tools with payments made using crypto assets.
Police also found that the use of Kratos is suspected to have caused victims in several countries, including Germany and the United States. This information was then conveyed to the relevant authorities, namely the United States’ Federal Bureau of Investigation (FBI) and Germany’s Bundeskriminalamt (BKA).
Brigadier General Adex stated that based on information from the German BKA, 7,981 parties were identified as being affected by attacks linked to the use of Kratos. The victims included employees of government agencies, companies, and organisations. In one case, access to the email account of an organisation’s leader was allegedly used to send a fake invoice worth EUR 28,146.32.
Meanwhile, he continued, the FBI found links between Kratos and phishing attacks against several parties, including a government agency in the State of Texas and a company in Illinois.
Head of Sub-Directorate I of Dittipidsiber Bareskrim, Senior Commissioner Guntur Muhammad Tariq, said the exchange of information with international partners helped investigators uncover the scale of Kratos’ use. “From the development of the investigation, we found victims in Germany and the United States. We conveyed this information to the BKA and FBI for follow-up according to their respective jurisdictions. This information exchange helped strengthen the identification of victims and the development of the case,” said Senior Commissioner Guntur.
Based on information from the FBI, Kratos had more than 1,784 customers with a transaction value reaching USD 317,074 through cryptocurrency payment services. Police are still investigating the buyers and users of these tools to uncover their involvement in phishing attacks.
After gathering sufficient evidence, the Unit 2 team of Sub-Directorate I of Dittipidsiber Bareskrim arrested MI in Pontianak on 11 July 2026, and he has been detained since 12 June 2026. Police also seized a number of electronic and digital evidence items and are tracing cryptocurrency transactions suspected to be linked to the proceeds of crime.
“Our target is not just to arrest one perpetrator, but to dismantle the ecosystem that allows these tools to be developed, traded, and used to attack victims,” said Brigadier General Adex Yudiswan.
MI is charged under Article 51 paragraph (1) in conjunction with Article 35 and/or Article 50 in conjunction with Article 34 paragraph (1) of Law Number 1 of 2024 concerning the Second Amendment to Law Number 11 of 2008 on Electronic Information and Transactions and/or Article 607 paragraph (1) letters a and c of Law Number 1 of 2023 concerning the Criminal Code related to Money Laundering.
Investigators are currently continuing to develop the case, including tracing other suspected involved parties, buyers and users of the phishing tools, additional victims, fund flows, assets resulting from criminal acts, and the digital infrastructure used. Bareskrim stated that uncovering Kratos is a step towards breaking the cybercrime chain from the upstream side, targeting not only the attackers but also those who provide the means for crime.