APT73 ransomware group lists tni.mil.id on its leak site

• Ransomware group: APT73
• Country: Indonesia
• Sector: Government & Defense
• Announcement date: February 25, 2025

The APT73 ransomware group has announced on its leak site that it has obtained and leaked a database belonging to the tni.mil.id domain. This claim involves the Indonesian National Army, with the group asserting that the breach includes significant amounts of sensitive personnel information. According to the announcement made on February 25, 2025, the leaked data is said to consist of 14,520 lines of records.

The details of the alleged breach

The APT73 group has officially claimed responsibility for the leak of the tni.mil.id database. According to the group's announcement, detailed information belonging to the institution's personnel has been successfully obtained. This type of activity is common in modern cyberattacks, where threat actors utilize leak sites to pressure organizations. In this specific instance, the group has initiated a countdown timer, a tactic often used to create urgency regarding the publication of the stolen data.

While the group has posted an announcement, no specific ransom demand has been disclosed in the provided information. Furthermore, no specific data size was provided by the group in their claim. The announcement is categorized as a data leak event, focusing on the exposure of sensitive information rather than a direct ransom negotiation at this stage of the public announcement.

The types of data involved

Based on screenshots provided in the group's announcement, the leaked data is highly sensitive, containing a mix of personal and military-specific information. The information allegedly obtained includes a wide range of identifiers that could be used to profile members of the armed forces. The specific data points identified in the claim include:

• Personnel names
• Personnel numbers (NRP)
• Rank information
• Unit information
• Position descriptions
• Date of birth
• Service duration
• Education details
• Religious belief
• Gender
• Phone numbers
• Home addresses

The inclusion of such diverse data points—ranging from basic identity markers to specific military service details—suggests a comprehensive extraction of personnel files.

The organization profile

The target of this alleged attack is tni.mil.id, which represents the Tentara Nasional Indonesia. The TNI is the official armed forces of Indonesia. Comprising the army, navy, and air force, the institution is responsible for the national defense and security of the country.

Security implications and organizational risks

The data claimed to be leaked may pose a high security risk for military personnel. The disclosure of such detailed personnel information could pave the way for targeted phishing attacks and sophisticated social engineering attempts. When attackers possess specific details like rank, unit, and service duration, they can craft highly convincing messages to manipulate individuals within the organization.

Such breaches can have negative impacts on the institution's operational security and the privacy of its personnel. Given the sensitive nature of the data, the leak may have potential implications for national security. While public information about the APT73 group remains limited, the impact of their actions on a national defense institution is significant.

In the broader context of cybersecurity, organizations in the government and defense sectors often face these types of threats. To mitigate such risks, it is common practice for institutions to implement robust defensive measures. These typically include multi-factor authentication (MFA) to prevent unauthorized access, strict network segmentation to limit the lateral movement of attackers, and continuous monitoring of sensitive databases to detect anomalous activity. Furthermore, comprehensive data encryption and regular security audits are essential components of a modern defensive posture to protect both institutional and individual privacy against evolving ransomware threats.