Indonesia’s Gambling Ecosystem Exposed With Indicators of National-Level Cyber Operations
A sophisticated cybercrime infrastructure operating for over fourteen years has been dismantled through extensive research into Indonesia's illegal gambling networks.
A sophisticated cybercrime infrastructure operating for over fourteen years has been dismantled through extensive research into Indonesia's illegal gambling networks.
Security researchers have uncovered a sprawling ecosystem spanning hundreds of thousands of domains, thousands of malicious mobile applications, and widespread domain hijacking across government and enterprise infrastructure worldwide.
The operation, active since at least 2011, demonstrates the financial resources, technical sophistication, and operational persistence typically associated with state-sponsored threat actors rather than ordinary cybercriminals.
What began as localized gambling activities has evolved into a multilayered infrastructure combining illegal gambling operations, search engine optimization manipulation, malware distribution, and persistent website takeover techniques.
The scale and complexity of this campaign represent one of the largest Indonesian-speaking cybercrime ecosystems observed to date.
The threat actor maintains control over approximately 328,039 domains, including 90,125 hacked domains, 1,481 compromised subdomains, and 236,433 purchased domains used primarily to redirect users to gambling platforms.
Malanta security analysts identified the malware ecosystem through methodical infrastructure mapping and threat intelligence collection.
The research revealed sophisticated attack chains and evasion capabilities embedded throughout the operation's technical foundation.
The scale and complexity of this campaign represent one of the largest Indonesian-speaking cybercrime ecosystems observed to date.
Android Malware Distribution and Persistence Tactics
The most concerning aspect involves thousands of malicious Android applications distributed through publicly accessible Amazon Web Services S3 buckets.
These applications function as sophisticated droppers designed to establish persistent device compromise while masquerading as legitimate gambling platforms.
Upon installation, the applications automatically download and install additional APK files without user knowledge, demonstrating advanced dropper capabilities.
The malware leverages Google's Firebase Cloud Messaging service to receive remote commands, enabling attackers to push instructions directly to infected devices without establishing traditional command-and-control connections.
Technical analysis revealed the malware includes hardcoded credentials and API keys for telemetry and device management.
The applications request dangerous permissions, including external storage read-write access, allowing attackers to exfiltrate sensitive data and stage additional payloads.
One particularly alarming discovery involved multiple APK samples sharing a common domain: jp-api.namesvr.dev, which functions as a centralized command-and-control server coordinating malware operations.
The infrastructure extends beyond Android devices to compromised subdomains on government and enterprise servers.
Attackers deployed NGINX-based reverse proxies terminating TLS connections on legitimate government domain names, effectively disguising malicious command-and-control traffic as legitimate government communications.
Over 51,000 stolen credentials originating from gambling platforms, infected Android devices , and hijacked subdomains were discovered circulating in dark web forums, directly linking victim data to this infrastructure.
This operation demonstrates how cybercriminals can weaponize trusted infrastructure at massive scale while maintaining operational security through domain diversity and sophisticated evasion mechanisms.
Based on reporting by Cyber Security News.