BANGKOK
\nIndia\u2019s power sector has been targeted by hackers in a long-term operation thought to have been carried out by a state-sponsored Chinese group, a US-based private cybersecurity company detailed in a new report.
\nOver the last several months, the Insikt Group, the threat research division of Massachusetts-based Recorded Future, said it has collected evidence that hackers targeted seven Indian state centers responsible for carrying out electrical dispatch and grid control near a border area disputed by the two nuclear neighbors.
\nThe group primarily used the Trojan ShadowPad, which is believed to have been developed by contractors for China\u2019s Ministry of State Security, leading to the conclusion that this was a state-sponsored hacking effort, the group reported.
\n\u201cShadowPad continues to be employed by an ever\u2013increasing number of People\u2019s Liberation Army and Ministry of State Security-linked groups, with its origins linked to known MSS contractors first using the tool in their own operations and later likely acting as a digital quartermaster,\u201d Recorded Future said in the report late Wednesday.
\nChina\u2019s Foreign Ministry spokesman Zhao Lijian said Thursday the report had been \u201cnoted\u201d by Beijing, but that China \u201cfirmly opposes and combats any form of cyberattacks, and will not encourage, support or condone any cyberattacks.\u201d
\n\u201cI would like to advise the company concerned that if they really care about global cybersecurity, they should pay more attention to the cyberattacks by the US government hackers on China and other countries, and do more to help promote dialogue and cooperation among countries, instead of using the cyberattack issue to stir up trouble and throw mud at China,\u201d he told reporters.
\nIndian External Affairs Ministry spokesperson Arindam Bagchi said India hasn\u2019t discussed the issue with China.
\n\u201cWe have seen reports. There is a mechanism to safeguard our critical infrastructure to keep it resilient. We haven\u2019t raised this issue with China,\u201d he said.
\nIndian Minister of Power R.K. Singh said the report was not a cause for concern.
\n\u201cWe are always prepared,\u201d he said. \u201cWe have a very robust security system. We are always alert.\u201d
\nInsikt Group already detected and reported a suspected Chinese-sponsored hack of 10 Indian power sector organizations in February 2021 by a group known as RedEcho. The more recent hack \u201cdisplays targeting and capability consistencies\u201d with RedEcho, but there are also \u201cnotable distinctions\u201d between the two so the group has been given the working name of Threat Activity Group 38, or TAG-38, as more information is gathered.
\nFollowing a short lull after its first report, Recorded Future said the Insikt Group again started tracking hacking attempts on India\u2019s power grid organizations. Over the last several months, through late March, it identified likely network intrusions targeting at least seven of India\u2019s so-called \u201cState Load Dispatch Centers\u201d \u2014 all in proximity to the disputed border in Ladakh, where Chinese and Indian troops clashed in June 2020, leaving 20 Indian soldiers and four Chinese dead.
\n\u201cRecorded Future continues to track Chinese state-sponsored activity groups targeting a wide variety of sectors globally \u2014 a large majority of this conforms to longstanding cyber espionage efforts, such as targeting of foreign governments, surveillance of dissident and minority groups, and economic espionage,\u201d the report said.
\n\u201cHowever, the coordinated effort to target Indian power grid assets in recent years is notably distinct from our perspective and, given the continued heightened tension and border disputes between the two countries, we believe is a cause for concern,\u201d it added.
\nHackers are thought to have gained access through third-party devices connected to the Internet, like IP cameras, which had been compromised, the company said.
\nInvestigators have not yet determined how they had been compromised, but Recorded Future suggested they may have originally been installed using default credentials, leaving them vulnerable.
\nBecause the prolonged targeting of India\u2019s power grid \u201coffers limited economic espionage or traditional intelligence-gathering opportunities,\u201d Recorded Future said it seems more likely the goal is to enable information gathering around surrounding critical infrastructure systems, or to be pre-positioned for future activity.
\n\u201cThe objective for intrusions may include gaining an increased understanding into these complex systems in order to facilitate capability development for future use or gaining sufficient access across the system in preparation for future contingency operations,\u201d Recorded Future said.<\/p>\n","protected":false},"excerpt":{"rendered":"
BANGKOK India\u2019s power sector has been targeted by hackers in a long-term operation thought to have been carried out by a state-sponsored Chinese group, a US-based private cybersecurity company detailed in a new report. Over the last several months, the Insikt Group, the threat research division of Massachusetts-based Recorded Future, said it has collected evidence […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-253596","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-world"},"yoast_head":"\n