Indonesian National Police and FBI Reveal Phishing Victims Involving Indonesians Reach 34,000 People

The Indonesian National Police’s Criminal Investigation Agency (Bareskrim Polri) has stated that victims of a cross-border phishing syndicate involving two Indonesian nationals number 34,000, including residents of the United States (US).

Director of Cybercrime at Bareskrim Polri, Brigadier General Himawan Bayu Aji, said that the two suspects, GWL and FYTP, carried out their operations using Virtual Private Server (VPS) services located abroad.

“The suspects also conducted automatic monitoring of sales and provided technical support services to buyers of phishing scripts who encountered issues,” he stated during a press conference on Wednesday (22/4).

He explained that the phishing tools were sold by the two perpetrators through the website w3llstore.com, with payments made using cryptocurrency to GWL’s account, after which the funds were transferred to FYT’s digital wallet.

Subsequently, the funds were converted into Rupiah and withdrawn using the personal bank account of suspect FYT.

“Investigators from the Cyber Directorate of Bareskrim Polri coordinated and collaborated with the FBI regarding data and information support on buyer and user identities, as well as victim data,” he clarified.

Himawan explained that from this collaboration, it was discovered that a total of 2,440 criminal actors purchased the phishing tools from GWL during the period from 2019 to 2024.

All transactions were confirmed using cryptocurrency assets recorded in the purchase history.

During that period, he said, there were approximately 34,000 identified victims from January 2023 to April 2024. Of that number, 17,000 victims, or approximately 50%, were confirmed to have experienced hacking or account compromise.

“This includes the success of the script in bypassing multi-layered security mechanisms or Multi-Factor Authentication,” he added.

He further noted that analysis of 157 victims showed that 53% were from the United States. Additionally, Himawan mentioned that nine Indonesian companies were among the victims.

“The estimated losses to the victims resulting from the use of scripts sold by the suspects, from January 2023 to April 2024, are around $20 million or approximately Rp350 billion,” he stated.