A Chinese hacking group called RedEcho is believed to have attacked Maharashtra’s electricity grid in March 2021, amidst an ongoing crisis in Ladakh. Hackears from North Korea penetrated the Kundankulam Nuclear Power Plant (KKNPP) in 2019 in a bid to test the cyber security of the plant and steal information about the reactor design.

Infrastructure Projects at Risk

India’s infrastructure projects, particularly those related to the country’s strategic interests, are considered to be at risk from cyberattacks by Chinese state-sponsored groups. These groups are known to have a significant capability in cyber espionage and have been accused of targeting infrastructure projects in other countries as well. In recent years, there have been a number of reported cyberattacks on Indian infrastructure projects, including attacks on power grids and transportation systems. The Indian government has acknowledged the risk and has taken steps to increase cybersecurity measures to protect its infrastructure projects, but it is a constant battle to stay ahead of the attackers.

PLA’s Cyber Attackers

In some ways, cyber war between India and China is already taking place – after India banned hundreds of Chinese mobile apps, limiting Chinese investments in the Indian economy and giving a bloody nose to the People’s Liberation Army on the Line of Actual Control on 15 June 2020.

In March 2013, DRDO’s computers were breached by Chinese hackers, who took files related to Cabinet Committee on Security (CCS), to a server in Guangdong in China and the Indian defence ministry ordered a probe.

China-linked hacker group, RedFoxtrot, from their intelligence Unit 69010, targeted India’s power sector, including conglomerate NTPC, in March 2021. RedFoxtrot’s predominant targets are sectors like government, defence, and telecommunications across Central Asia, India, and Pakistan.

Some Indian targets included Walchandnagar Industries engaged in India’s Nuclear and Space programmes, and defence manufacturer Alpha Design Technologies and Bharat Sanchar Nigam Limited (BSNL).

The Times Group (Feb, Aug 2021), Unique Identification Authority of India (UIDAI), and MP Police Department (June 2021) have been targeted by suspected Chinese state-sponsored threat activity group TAG-28, which used Winnti malware. In June 2021, APT41 was responsible for cyber attack against Air India.

Recent Initiatives

The creation of the Defence Cyber Agency in 2019, Cyber Security Coord at the National Security Council (NSC), preparedness for offensive ops by the National Technical Research Organisation (NTRO), defensive measures by National Critical Info Infrastructure Protection Centre (NCIIPC) and the release of India’s National Cyber Security Policy (NCSP) are steps in the right direction. As roles and responsibilities of the armed forces, other government agencies as well as the private sector are articulated, the nation’s vulnerability to cyber attacks will decrease.

The vulnerabilities facing India’s Critical Infrastructure (CI) need to be addressed with greater urgency. Cyber attacks against India’s CI and Strategic Infrastructure (ST), such as nuclear power plants, are not new.

Defensive measures like having a cyber security framework, Cyber Security Awareness, Incident Response Tools, Vulnerability Assessment and Penetration Testing, Multi-Factor Authentication and so on are necessary but offensive defence is the key. Along with space, Indian must prepare for “cross-domain” warfare to include cyberspace.

Comments

China has been leading a worldwide hacking and economic espionage campaign, using cyber attacks to steal intellectual property in disregard of bilateral and multilateral agreements.

China is one of the world’s pre-eminent players using cyber weapons. Used as methods of espionage, state-sponsored data breaches and server hacks pose a significant threat to global security. China was responsible for worldwide rise of cyber crime by 600% during the Covid-19 pandemic. Even before the virus hit, China had overtaken Russia as the biggest state sponsor of cyber attacks against the West.

The People’s Liberation Army (PLA) of China is known to have trained hackers and offensive cyber groups for operations. These groups are believed to have been involved in a number of cyber espionage and cyber-attacks against various countries, including the United States and India. The PLA’s cyber units are thought to be well-funded and well-equipped, with a focus on both defensive and offensive capabilities. In addition to targeting government and military organizations, these groups have also been known to target private companies, particularly those in the technology and aerospace sectors. The Chinese government has denied any involvement in cyber-attacks, but evidence suggests otherwise. The US and other countries have accused China of using cyber espionage to gain an economic and strategic advantage.

The post India’s Vulnerability to Chinese Cyber Attacks appeared first on IMR.

In some ways, cyber war between India and China is already taking place – after India banned hundreds of Chinese mobile apps, limiting Chinese investments in the Indian economy and giving a bloody nose to the PLA on the LAC on 15 June 2020.

Extensive operations in the fifth domain of warfare, ie, cyber space have, been a reality for decades, the other domains being land, sea, air, and space. The primary objective is cyber military superiority to provide freedom of action in, through, and from cyberspace to support mission objectives. The corollary is to deny freedom of action to adversaries.

Chinese Cyber Attacks

China has been leading a worldwide hacking and economic espionage campaign, using cyber attacks to steal intellectual property in disregard of bilateral and multilateral agreements.

China is one of the world’s pre-eminent players using cyber weapons. Used as methods of espionage, state-sponsored data breaches and server hacks pose a significant threat to global security. China was responsible for worldwide rise of cyber crime by 600% during the Covid-19 pandemic. Even before the virus hit, China had overtaken Russia as the biggest state sponsor of cyber attacks against the West.

Some of the Chinese cyber attacks that have made digital history in the past include:

• Operation Aurora (Jan 2010) affected Internet Explorer, Google and Adobe.

• New York Times’s employees, in Jan 2013, were attacked after it published an investigation into how relatives of the then Chinese prime minister, Wen Jiabao, accrued several billion dollars through business dealings.

• The personnel files of more than 20 million people of the US Office of Personnel Management (OPM), were stolen from Nov 2013 to April 2015.

• Four Chinese military hackers were indicted in 2020, for stealing data of 147 million Americans customers of credit-reporting agency Equifax.

• The Vatican’s computer systems were attacked (100 cyber threats a month) by suspected state-sponsored Chinese hackers in July 2020.

• Two Chinese hackers were indicted, on 7 July 2020, in a bid to steal data from Moderna Inc, the vaccine manufacturer.

Indian Targets

In March 2013, DRDO’s computers were breached by Chinese hackers, who took files related to Cabinet Committee on Security (CCS), to a server in Guangdong in China and the Indian defence ministry ordered a probe.

China-linked hacker group, RedFoxtrot, from their intelligence Unit 69010, targeted India’s power sector, including conglomerate NTPC, in March 2021. RedFoxtrot’s predomi-nant targets are sectors like government, defence, and telecommun-ications across Central Asia, India, and Pakistan.

Some Indian targets included Walchandnagar Industries engaged in India’s Nuclear and Space programmes, and defence manufacturer Alpha Design Technologies and Bharat Sanchar Nigam Limited (BSNL).

The Times Group (Feb, Aug 2021), Unique Identification Authority of India (UIDAI), and MP Police Department (June 2021) have been targeted by suspected Chinese state-sponsored threat activity group TAG-28, which used Winnti malware. In June 2021, APT41 was responsible for cyber attack against Air India.

Russia-Ukraine War

Ukraine launched cyber attacks under Operation Groundbait in May 2016. The Surkov Leaks in Oct 2016 made public 2,337 e-mails and hundreds of attachments, with plans for seizing Crimea from Ukraine and fomenting separatist unrest in Donbas. The IT Army of Ukraine was established in Feb 2022 during the 2022 Russian invasion of Ukraine.

Anonymous, the hacker collective has declared cyberwar on Russia. The group has claimed credit for hacking the Russian Ministry of Defence database, and is believed to have hacked multiple state TV channels to show pro-Ukraine content.

The group has claimed credit for several distributed denial of service attacks. Its targets in the past have included the CIA, the Church of Scientology and Islamic State.

Anonymous’ Russian targets included:

• Roskomnadzor, the Russian government agency in charge of controlling access to social media sites.

• Russian news channels Russia 24, Channel One, and Moscow 24.

• Kremlin’s official website, the Ministry of Defence database, over 300 Russian media, as well as banking websites.

• Hacktivists wanted to keep Russians connected to the rest of the world and alternative media by publishing their data in the hope of exposing the censorship that the Russian government was putting on its citizens.

Recent Initiatives

The creation of the Defence Cyber Agency in 2019, Cyber Security Coord at the National Security Council (NSC), preparedness for offensive ops by the National Technical Research Organisation (NTRO), defensive measures by National Critical Info Infrastructure Protection Centre (NCIIPC) and the release of India’s National Cyber Security Policy (NCSP) are steps in the right direction. As roles and responsibilities of the armed forces, other government agencies as well as the private sector are articulated, the nation’s vulnerability to cyber attacks will decrease.

The vulnerabilities facing India’s Critical Infrastructure (CI) need to be addressed with greater urgency. Cyber attacks against India’s CI and Strategic Infrastructure (ST), such as nuclear power plants, are not new.

Defensive measures like having a cyber security framework, Cyber Security Awareness, Incident Response Tools, Vulnerability Assessment and Penetration Testing, Multi-Factor Authentication and so on are necessary but offensive defence is the key. Along with space, Indian must prepare for “cross-domain” warfare to include cyberspace.

The post Editorial—Cyber Attacks on the Rise appeared first on IMR.

The elusive computer experts issued the stark announcement on their Twitter account on 24 February evening.

They said shortly before 10pm: ‘The Anonymous collective is officially in cyber war against the Russian government.’

Around 30 minutes later, they announced that they had taken down the website of the Kremlin-backed TV channel RT, which broadcasts in Britain and has been heavily criticised for its coverage.

When MailOnline attempted to access the site this morning, it was still inaccessible and only displayed an error message that said ‘this site can’t be reached’.

The cyber war declaration raises the prospect that Russia could be subjected to systematic hacking attempts in the coming days.

Prior to the invasion of Ukraine, on 24 February, the country’s government and banks were targeted by a massive cyber attack that was believed to have been carried out by Russia.

People on social media responded positively to Anonymous’s cyber war declaration against Putin.

The post Hacking group Anonymous declares cyber war on Putin’s government appeared first on IMR.

There is good reason to suspect China-Pak collaboration in cyberspace. In recent years, Beijing and Islamabad have deepened their co-operation in the information technology domain. Digital and cyber co-operation are crucial elements of the ‘Long-Term Plan for China-Pakistan Economic Corridor (2017-2030)’. The plan emphasises ICT-enabled development and promotion of e-commerce in Pakistan.

But beyond this benign collaboration, China-Pakistan collusion has become a reality where Pakistan has emerged as a proxy for China’s malicious designs. This is particularly true with respect to anti-India propaganda on social media platforms.

During the ongoing border stand-off between India and China along the Line of Actual Control, Pakistan-based Twitter handles posing as Chinese nationals have peddled anti-India propaganda. These Twitter handles have regularly peddled misleading reports related to the violent clash at Galwan Valley in June 2020, as well as about India’s military preparedness. China and Pakistan are also potentially exploring establishing an international news media outlet that will significantly advance their propaganda efforts. Besides, in 2018, both had reportedly joined hands to honey trap Indian Army officers into revealing information regarding troop deployments along the borders with China and Pakistan.

The Chinese side has taken the lead by providing the technology and content, while Pakistan acts as the implementer and disseminator. This collaboration is symbiotic: China needs Pakistan because mainstream social media platforms such as Twitter and Facebook are banned in China, and command over the English and Hindi languages is very limited in most parts of China’s populace. Moreover, by not directly getting involved and making Pakistan the front end of the anti-India activity, China is able to skirt attribution. For Pakistan, collaborating with China strengthens its strategic partnership and lends the technical edge, which Islamabad’s cyber activities wouldn’t have been able to achieve otherwise.

This cyber collusion is also likely to extend to malicious cyber activities such as APT attacks, with the intention to collect valuable geopolitical, business, and military data. Indian cybersecurity researchers have suspected Chinese assistance to Pakistani cyber campaigns like APT36’s ‘Operation Sidecopy.’ The APT36 is a known threat actor that has used fake COVID-19 health advisory to launch phishing attacks against Indian defence networks to steal confidential information. The threat vector had been active since 2016, indicative of its long duration. Most recently, Pakistan-based hackers conducted a major cyber-attack targeting India’s power generation and transmission sector using the platform supplied by China Mobile Limited, which operates under the brand Zong 4G in Pakistan.

Evidence of Pakistan’s emergence as China’s proxy in cyberspace lies not only in China’s active role in enhancing Pakistan’s ICT infrastructure as part of the China-Pakistan Economic Corridor (CPEC), but more so in the modus operandi of cyber actors in both countries at the tactical level involving fake propaganda-based influence operations, and espionage using malware as well as honey traps.

With China-Pakistan cyber collusion becoming a reality, India must prepare for the spectre of a ‘two-front war’ in cyberspace. While their cyber-espionage operations cause loss of sensitive information, their disinformation campaigns — based on anonymity and deniability — pose the real danger of accentuating the existing political polarisation, and social divisions within India.

Moreover, these disinformation campaigns can yield a significant advantage to Pakistan and China by sowing the seeds of doubt among the citizens about their national institutions’ credibility. Therefore, India needs to effectively counter the menace of China-Pakistan cyber collaboration as it has not just national security implications, but indeed implications for India’s democracy as a whole.

In recent years, India has taken steps to plug its cyber vulnerabilities through several legal and institutional measures. Yet, Chinese and Pakistani hackers continue to capitalise on the lack of adequate cybersecurity awareness and poor cyber hygiene practices, such as not checking the veracity of ‘fake news’, clicking on unsolicited web links, among average Indian Internet users, to ensure that their propaganda efforts get the necessary traction, and their malwares breach sensitive computer networks.

Therefore, even as India strengthens its cyber defences by plugging its vulnerabilities, it must implement two steps. At the micro-level, India should increase the citizens’ resilience to emerging cyber threats, and expand cyber hygiene initiatives. At the macro-level, India must amplify its offensive cyber posture to clearly signal its intentions and deter its adversaries.

These steps are necessary for India to prepare for China-Pakistan’s ‘hybrid warfare’.

The post Pakistan collaborating with China in cyber attacks against India appeared first on IMR.