Starting from a Malware Attack, How a Fraud Syndicate Deceived a US Company
US company IQ Power Tools fell victim to a business email compromise (BEC) fraud scheme. The perpetrators successfully intercepted the company’s communications, ultimately carrying out a cybercrime that caused losses amounting to billions of rupiah.
The case was uncovered by the Directorate of Cyber Crime at the Indonesian National Police Criminal Investigation Agency (Dittipidsiber Bareskrim Polri), in synergy with the Federal Bureau of Investigation (FBI) and the Indonesian Financial Transaction Reports and Analysis Centre (PPATK). The fraud syndicate was masterminded by a Chinese national with the initials CW, who remains at large. Two other perpetrators, Indonesian national LPK and Chinese national LJ, were arrested.
Head of Sub-Directorate I of Dittipidsiber Bareskrim Polri, Senior Commissioner Deddy Supriadi, said the case began when IQ Power Tools conducted a trade transaction with a Chinese company, Duro Machinery Corp. The perpetrators then launched a malware attack on the US company’s email address.
“The modus operandi carried out by this syndicate was that they created a script containing malware aimed at the victim’s business email,” Deddy said at a press conference at Bareskrim Polri, South Jakarta, Wednesday (19/8/2026).
Deddy said the malware attack was disguised as a message from the partner company. The perpetrators were known to have created a fake email to infiltrate the company’s communications.
“After the victim’s email responded, the suspects could then see the communications that emerged between the company in China selling computer hardware and the victim,” Deddy explained.
From there, the perpetrators managed to monitor the flow of inter-company communications. They then pretended to be the partner to direct the payment transaction.
Deddy said perpetrator CW then instructed suspect LPK to create the legal entity for a fictitious company named PT Aksesoris Andalan Bersama. The company was equipped with a bank account in Indonesia to receive the proceeds of the fraud.
Using the fake email, the perpetrators continued communicating with IQ Power Tools regarding the payment transaction. They then directed that the payment be diverted to the account of their subsidiary in Indonesia.
“The suspects then communicated with the victim and informed them that the payment transaction needed to be diverted because they were facing an audit process by the local supervisory commission,” Deddy explained.
“To avoid any loss or failure of payment, they provided guidance to divert the payment to their subsidiary in Indonesia. So the perpetrators succeeded in hacking the victim’s email,” he continued.
As a result of this crime, IQ Power Tools suffered losses of up to USD 350,325, or approximately IDR 6.2 billion. Investigators managed to block the account of PT Aksesoris Andalan Bersama, which still had a balance of USD 285,859, equivalent to IDR 5 billion.
The suspects are charged under Article 51 paragraph 1 in conjunction with Article 35 of the Electronic Information and Transactions Law on electronic data manipulation, Article 492 of the Criminal Code on fraud, Articles 82 and 85 of Law Number 3 of 2011 on Fund Transfers, and Article 607 of the Criminal Code on money laundering, with a maximum penalty of 15 years in prison.