What Is Bashe Ransomware Allegedly Attacking BRI Bank?

Bashe Ransomware (photo: Vectra AI)

JAKARTA - Recently, Bank Rakyat Indonesia (BRI) was suspected of having suffered an attack by Bashe Ransomware. Even so, the Bank said that currently the customer's funds and data are safe. Then, what is Bashe Ransomware?

What's Bashe?

Cybersecurity firm Vectra AI said Bashe is a ransomware group, which has been operating since mid-April 2024.

Bashe was previously known as APT73 or Eraleig, which is believed to be a fraction of the famous LockBit ransomware group, based on similarities in the site structure of their data leakage.

How Bashe works

"Bashe operates through the Tor network with hosted infrastructure in the Czech Republic. It relies on AS9009 ASN for hosting, a network previously used by several malicious groups and malware, including DarkAngels, Vice Society, TrickBot, Meduza Stealer, and Rimasuta," Vectra AI wrote on its official website.

Target

The group's activities have reportedly affected various organizations in developed countries with valuable data assets including North America, Britain, France, Germany, India, and Australia.

Bashe is also seen prioritizing targets in high-value sectors, such as the technology sector, business services, manufacturing, consumer services, financial services, transportation, logistics, health care, and construction.

So far, the cybersecurity company says Bashe has carried out attacks on 35 victims.