Bjorka
Attribution profile
- Type
- Hacker
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 2 sources
- First seen
- 2022-08-21
- Last seen
- 2023-07-01
- Updated
- 2026-10-14 06:09
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Bjorka is a threat actor known by that alias and is reported to be based in Russia. The actor has targeted Indonesian government agencies and telecommunications providers, exfiltrating large volumes of personal data and offering it for sale on hacking forums such as BreachForums. Observed tactics include stealing databases containing identity card numbers, names, dates of birth, addresses, polling station details, passport information, and subscriber browsing history, then posting the data for financial gain. No specific malware families, initial access vectors, or tooling are described in the available sources. Public attribution does not establish a state nexus or criminal consortium affiliation beyond the actor’s location. Notable campaigns linked to Bjorka include the 2022 leak of over 105 million Indonesian citizens’ data from the General Elections Commission, the 2023 breach of Indonesia’s Immigration Directorate General exposing 34 million passport holders, and the 2022 IndiHome telecommunications breach affecting roughly 26.7 million subscribers’ browsing histories.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 2 sources.