Indonesia Security Report — November 09, 2026

Security analysis based on open-source intelligence and web research. Period: November 02 — November 09, 2026.

Comprehensive Security Analysis Report: Indonesia (November 02 - November 09, 2026)

Executive Summary

During the period of November 02 to November 09, 2026, Indonesia experienced a dynamic security landscape marked by significant internal developments and crucial diplomatic advancements. A major military deployment of over 20,000 troops in Jakarta was initiated following an alleged illegal wiretapping scandal targeting President Prabowo Subianto, raising concerns about internal political stability. Concurrently, the nation faced a substantial volume of cyberattacks, with hundreds of thousands of detections targeting financial and government sectors. Diplomatically, Indonesia made considerable strides towards finalizing the Indonesia-European Union Comprehensive Economic Partnership Agreement (IEU-CEPA) and intensified its campaign for a seat on the International Civil Aviation Organization (ICAO) Council. These events collectively underscore an elevated security posture, driven by both domestic political sensitivities and persistent cyber threats, alongside strategic international engagement.

Key Security Developments

• Massive Troop Deployment in Jakarta Amid Wiretapping Scandal
  The Indonesian Military (TNI) deployed approximately 20,980 personnel to Jakarta starting November 2, 2026, with reinforcements arriving in stages. This significant military movement was publicly described as routine readiness to maintain national security and territorial integrity. However, it coincided with an ongoing investigation into alleged illegal wiretapping operations targeting President Prabowo Subianto and other high-ranking officials, which led to the detention of three senior police generals. The presidential palace indicated that the alleged surveillance, which reportedly occurred between 2025 and 2026, could be considered an act "leading toward treason" due to the sensitive information potentially compromised.

• Military Helicopter Crash in Central Kalimantan
  On November 4, 2026, an Indonesian Army Aviation Mi-17V-5 helicopter (registration HA-5235) crashed in Central Kalimantan during a forest fire response mission in Seruyan. The incident resulted in the deaths of three crew members, with the body of First Sergeant Heri Prasetyo recovered on November 5, 2026. The helicopter encountered problems while collecting water for a water-bombing operation off Sungai Perlu village.

• Progress on Indonesia-European Union Comprehensive Economic Partnership Agreement (IEU-CEPA)
  Indonesia and the European Union made substantial progress towards the official signing of the IEU-CEPA, targeted for November 21, 2026. On November 4, 2026, EU member state ambassadors prepared for the signing and conclusion of the agreement. Furthermore, on November 6 and 8, 2026, President Prabowo Subianto received credentials from 11 new foreign ambassadors, including the EU's designated ambassador, Hervé Delphini, who emphasized the critical moment for a strategic partnership between Indonesia and the EU.

• Intensified Diplomacy for ICAO Council Seat
  Indonesia's Transportation and Foreign Affairs Ministries intensified diplomatic efforts to secure global backing for the nation's bid for a Category III Council seat in the International Civil Aviation Organization (ICAO). As of November 6, 2026, Jakarta had garnered written support from 28 countries and verbal indications from 69 others, ahead of the 43rd ICAO Extraordinary Assembly Session scheduled for November 19–20, 2026, in Montreal, Canada.

• Significant Cyberattack Detections Targeting Key Sectors
  Indonesia experienced a high volume of cyberattack detections during the reporting period. FortiGuard Labs' live threat map dashboard recorded approximately 657,000 cyberattacks blocked within a 24-hour period on November 8, 2026, at a rate of up to 8 attacks per second. Separately, in the 24 hours leading up to November 7, 2026, FortiGuard Labs detected approximately 350,600 cyber threat activities across Indonesia, with the banking, finance, and insurance sectors accounting for 61% (around 214,000 threats) and government agencies and critical infrastructure also being primary targets.

• Security Advisory on Hirudo Android Malware
  On November 4, 2026, Indonesia's National Cyber and Crypto Agency (BSSN) issued a security advisory warning commercial banks, fintech firms, and energy utilities about a hybrid fileless ransomware and Android malware known as Hirudo. This malware reportedly targeted eight mobile banking applications from seven Indonesian banks and was capable of stealing customer PINs.

• Strengthened Border Security with Interpol Global Hit Alert System
  Indonesia enhanced its border security capabilities with the launch of the Interpol Global Hit Alert System (I-GHAS 24/7) application on November 5, 2026. Launched by the National Police Chief, General Suyudi Ario Seto, this system, linked to 196 Interpol member countries, improves the speed and accuracy of detecting international fugitives and perpetrators of transnational crimes at border checkpoints.

• Clash with Free Papua Movement (OPM) in Papua Pegunungan
  On November 7, 2026, the Indonesian military (TNI) engaged in a firefight with members of the Free Papua Movement (OPM) in the Kali Senami area of Dekai District, Yahukimo Regency, Papua Pegunungan. Following the clash, TNI Habema Operations Commander Brig. Gen. Riyanto reported the seizure of seven firearms from a suspected OPM hideout.

• Easing of Foreign Exchange Lock-Up Rule for Key Trading Partners
  On November 6, 2026, Indonesia announced an easing of its foreign exchange retention rule for natural resource exporters from major trading partners, including the European Union, Japan, and South Korea. This decision reflects Indonesia's commitment to strengthening economic ties and attracting investment, particularly in anticipation of the IEU-CEPA implementation.

• Multinational Military Medicine Exercise Trident Resolve
  Indonesia co-chaired Exercise Trident Resolve with the United States in Banten Province, which concluded on November 9, 2026. This multinational military medicine exercise simulated complex humanitarian assistance and disaster relief (HADR) scenarios, including earthquakes, volcanic eruptions, and tsunamis, enhancing coordination for medical care in degraded infrastructure environments.

Cyber Threat Landscape

Indonesia's cyber threat landscape during this period was characterized by a high volume of detected attack attempts, primarily targeting its financial and government sectors. FortiGuard Labs reported an alarming 657,000 cyberattacks blocked within a 24-hour window on November 8, 2026, indicating a persistent and intense level of malicious activity. A separate report for the 24 hours leading up to November 7, 2026, identified approximately 350,600 threat detections across the country, with financial institutions absorbing 61% of these threats (around 214,000 detections). While these figures represent detected threats and not necessarily successful intrusions, they highlight the continuous pressure on Indonesia's digital infrastructure.

In response to these threats, the National Cyber and Crypto Agency (BSSN) issued a significant security advisory on November 4, 2026, warning commercial banks, fintech firms, and energy utilities about the Hirudo Android malware, which targets mobile banking applications for PIN theft. This proactive measure underscores the government's awareness of specific threats to critical financial services. BSSN also emphasized the crucial role of human oversight in managing AI-related cybersecurity risks and launched a technical guidance program for 35 central government agencies to enhance their Cyber Incident Response Teams' (CSIRTs) preparedness and capabilities.

Regarding specific threat actors and past incidents from the provided structured data, no new significant developments or reported activities by ToddyCat, LOTUS PANDA, APT17, Naikon, GOBLIN PANDA, Hellsing, or new incidents related to the SecFlow Campaign, BlueMoon zero-day exploit, Gunra Ransomware, or Salt Typhoon were publicly reported within this specific November 02-09, 2026, timeframe. However, the consistent high volume of detected cyberattacks suggests that state-sponsored and criminal actors remain active against Indonesian targets, necessitating continued vigilance and robust defensive measures.

Geopolitical Impact and Regional Dynamics

The recent security developments in Indonesia carry significant geopolitical implications, both domestically and regionally. The large-scale military deployment in Jakarta, linked to an alleged wiretapping scandal, signals potential internal political instability and raises questions about civil-military relations and governance transparency. This internal focus could temporarily divert attention from broader regional engagements, although official statements emphasize routine readiness.

Regionally, Indonesia's intensified diplomatic push for an ICAO Council seat demonstrates its ambition to play a more prominent role in global aviation governance and enhance its influence as the world's largest archipelagic state and a major Asia-Pacific aviation market. The easing of tensions with Singapore, particularly concerning haze and gas issues, through renewed high-level communication, is a positive development for ASEAN regional cohesion and economic cooperation.

The progress towards the IEU-CEPA signing is a crucial step in strengthening Indonesia's economic ties with a major global power bloc, potentially diversifying its trade relationships and reducing over-reliance on any single partner. This aligns with Indonesia's "Bebas dan Aktif" (free and active) foreign policy, seeking to enhance economic strength for geopolitical influence. President Prabowo's emphasis on food self-reliance as a national security issue, involving the Ministry of Defense in large-scale food estate projects in Papua, highlights a strategic shift towards domestic resilience, which could have implications for regional agricultural trade dynamics, potentially affecting traditional rice exporters like Thailand. The co-chairing of Exercise Trident Resolve with the United States in Banten Province underscores Indonesia's continued security cooperation with major powers, particularly in humanitarian assistance and disaster relief, which is vital for regional stability in a disaster-prone area.

EU Relations and Implications

Indonesia's relations with the European Union have seen significant positive momentum during this period, primarily driven by the impending signing of the Indonesia-European Union Comprehensive Economic Partnership Agreement (IEU-CEPA). The agreement is targeted for official signing on November 21, 2026, with EU member state ambassadors having prepared for its conclusion on November 4, 2026. This trade pact is expected to liberalize approximately 98% of tariff lines, providing greater market access for Indonesian exports such as palm oil derivatives, textiles, and footwear, while also opening the Indonesian market for EU exports. The EU's designated ambassador to Indonesia, Hervé Delphini, presented his credentials to President Prabowo on November 6 or 8, 2026, emphasizing that the relationship is entering a "critical moment" for a strategic partnership amidst global geopolitical and economic uncertainties.

Further reinforcing economic ties, Indonesia eased its foreign exchange retention rule for natural resource exporters from the EU, Japan, and South Korea on November 6, 2026, acknowledging existing trade agreements and investment volumes. The "Indonesia–EU Business Forum 2026" was also held in Brussels on November 6, 2026, focusing on trade, transformation, and partnership ahead of the IEU-CEPA implementation. These developments align with the "Stable" EU relationship outlook assessed in August 2026 and support ongoing EU cooperation projects in sectors like Trade & Investment, Development Cooperation, Climate & Environment, Infrastructure & Transport, and Education & Skills. The high volume of cyberattacks detected in Indonesia, particularly against financial and government sectors, poses a potential risk to EU interests and EU-funded digital cooperation projects like SCOPE Digital – Copernicus Earth Observation Southeast Asia, necessitating robust cybersecurity measures to protect shared digital infrastructure and data.

Military and Defense Analysis

The Indonesian military's posture during this period was notably characterized by a large-scale internal security deployment and ongoing operational commitments. The deployment of over 20,000 TNI personnel to Jakarta, commencing November 2, 2026, ostensibly for routine readiness, is a significant event, especially given its proximity to the alleged wiretapping scandal involving high-ranking police officials and the president. While military spokesmen maintained it was standard procedure, the timing suggests a heightened state of alert related to internal political stability, potentially indicating a readiness to manage public order or deter unrest. This deployment, involving Marine Corps, First Fleet Command, and other units, demonstrates the TNI's capacity for rapid mobilization and its role in national security beyond external defense.

Modernization programs and capability developments were also evident through participation in multinational exercises. The co-chairing of Exercise Trident Resolve with the United States in Banten Province, which concluded on November 9, 2026, focused on military medicine and humanitarian assistance/disaster relief (HADR) scenarios. This exercise, involving Indonesia's hospital ship KRI Dr Soeharso, highlights an ongoing commitment to enhancing HADR capabilities, which are crucial for a disaster-prone archipelagic nation. The tragic crash of an Indonesian Army Aviation Mi-17V-5 helicopter in Central Kalimantan on November 4, 2026, during a firefighting mission, underscores the inherent risks in military operations, particularly those involving older equipment or challenging environmental conditions, and may prompt reviews of operational safety protocols and equipment maintenance. Furthermore, the Ministry of Defense's involvement in large-scale food estate projects in Papua, as part of President Prabowo's food security policy, indicates a strategic shift where defense resources and planning are increasingly integrated into broader national development and resilience objectives.

Outlook and Forecast

Short-term trends (1-3 months): In the immediate future, Indonesia's security landscape will likely be dominated by the fallout from the alleged wiretapping scandal and the ongoing investigation involving senior police generals. The large military presence in Jakarta may persist as authorities seek to ensure stability and public order, especially with planned demonstrations for National Heroes Day on November 10, 2026. The finalization and signing of the IEU-CEPA on November 21, 2026, will be a key diplomatic and economic highlight, followed by the ratification process. Indonesia will also be intensely focused on its bid for an ICAO Council seat at the assembly on November 19-20, 2026. The high volume of cyber threats is expected to continue, particularly targeting financial and government sectors, necessitating sustained vigilance and defensive measures.

Critical flashpoints and risk areas: Critical flashpoints include potential political unrest or public dissatisfaction stemming from the wiretapping scandal and its investigation, which could challenge internal stability in Jakarta. The ongoing conflict with the Free Papua Movement (OPM) in Papua Pegunungan remains a persistent security concern, with continued clashes and military operations expected. The cyber domain represents a significant risk area, with the potential for successful breaches despite high detection rates, which could compromise critical infrastructure, financial stability, or sensitive government data. Any delays or complications in the IEU-CEPA ratification could also introduce economic uncertainty.

Indicators to monitor: Key indicators to monitor include the progress and transparency of the wiretapping investigation, particularly any further arrests or revelations that could impact public trust or political stability. The successful signing and subsequent ratification of the IEU-CEPA will be crucial for Indonesia's economic outlook and its relationship with the EU. Reports on cyber incidents, especially confirmed breaches or the exploitation of vulnerabilities like the Hirudo Android malware, will indicate the effectiveness of national cybersecurity defenses. Developments in Papua, including any escalation of conflict or changes in military strategy, should also be closely watched. Furthermore, the outcome of Indonesia's ICAO Council bid will reflect its growing international influence.

Strategic recommendations: To mitigate risks, Indonesia should prioritize transparency and due process in the wiretapping investigation to restore public confidence and maintain institutional credibility. Strengthening national cybersecurity capabilities, including continuous threat intelligence sharing, vulnerability management, and enhanced incident response training for government and critical infrastructure sectors, is paramount given the high volume of cyberattacks. Continued diplomatic engagement, particularly in securing international support for its ICAO bid and ensuring smooth IEU-CEPA implementation, will reinforce Indonesia's global standing. Domestically, a comprehensive strategy for Papua that combines security operations with socio-economic development and dialogue remains essential to address the root causes of conflict.

Sources

• jakartaglobe.id
• kompas.com
• kompas.com
• washingtonpost.com
• arabnews.com
• kalkine.ca
• courthousenews.com
• antaranews.com
• antaranews.com
• wisevoter.com
• myanmaritv.com
• kompas.com
• antaranews.com
• antaranews.com
• rri.co.id
• kompas.id
• hokanews.com
• theasianglobe.com
• bittime.com
• antaranews.com
• antaranews.com
• jakartaglobe.id
• defence.gov.au
• govinsider.asia
• accesspartnership.com
• eurasiareview.com
• asiatimes.com
• rri.co.id
• ahk.de
• eurococoa.com