New Malware Exploits TASPEN Legacy Systems to Target Indonesian Elderly

Threat actors are leveraging the trusted brand of Indonesia’s state pension fund, PT Dana Tabungan dan Asuransi Pegawai Negeri (Persero), or TASPEN, to deploy a malicious Android application disguised as an official portal. The banking trojan and spyware targets pensioners and civil servants, exploiting legacy systems and digital transformation vulnerabilities to steal data including banking credentials, SMS-based one-time passwords, and biometric information via facial video capture.

The operation, which mimics TASPEN’s branding in Bahasa Indonesia, begins with a phishing website that lures victims into downloading the APK, using advanced evasion techniques to bypass detection and facilitate real-time data exfiltration to a command-and-control server.

According to CloudSek report, the malware is packed with DPT-Shell for DEX encryption, unpacks at runtime, and drops a ZIP payload containing malicious dex files into the device’s code_cache directory, revealing modular spyware components upon execution. Key services include SmsService, ScreenRecordService, CameraService, and ContactData classes, with communication to a C2 server over encrypted HTTP POST and a WebSocket channel for instant commands.