Chinese hacked into India’s power grid just to show that they can
Chinese cybercriminals, dubbed RedEcho, are targeting India’s power gridwith background Trojans called ShadowPad.
- The investigation by Recorded Future identifies 10 distinct power sector organisations and two maritime ports as targets of RedEcho.
- The cybersecurity firm points out that this infiltration has little to offer in terms of economic espionage, but could be used as a ‘show of force’, a tool to sway public opinion or serve as research for bigger attacks in the future.
Chinese cybercriminals are targeting the
An investigation conducted by the firm’s Insikt Group claims to have discovered a steep rise in the attacks against many companies in India’s power sector.
“10 distinct Indian power sector organisations, including 4 or the 5 Regional Load Despatch Centres (RLDC)... have been identified as targets in a concerted campaign against India's critical infrastructure,” said the report. Chidambaranar and Mumbai ports were also identified as targets.
However, Recorded Future pointed out that infiltration of RLDCs have very little to offer in terms of meeting any economic espionage objectives. But it does have its uses.
Regardless of whether the attack itself was severe or not, the electric grid falls into the critical infrastructure category. The report believes such attacks are ideal for posturing and can deliver potential outcomes such as:
- To be a robust signaling message as a ‘show of force’
- To enable influence operations to sway public opinion during a diplomatic confrontation
- To support potential destructive cyber operations against critical infrastructure in the future
The two Asian giants were involved in their first fatal border clash in 45 years in June last year. Since then, their military forces have been locked in a face-off along multiple frictions points in Leh, especially along the southern banks of Pangong Tso Lake.
Who are these Chinese Hackers?
The first thing to note is that these attacks were using ShadowPad, which is one of the largest known supply-chain attacks, according to cybersecurity firm Kaspersky.
AdvertisementIt is a covert background malware, which hides inside legit software. Once activated, it allows hackers to access the system in order to install more malicious software or steal data.
Even though the investigators spotted some overlaps with other cybercriminal groups — like APT41, known for the NetSarang incident using ShadowPad, and Tonto Team — they don’t believe that there is enough evidence to pin the blame on any known perpetrators.
In addition to APT41 and Tonto Team, ShadowPad is used by at least three other distinct Chinese groups. So, instead, this closely-related but distinct activity group has been dubbed RedEcho.
Elon Musk is facing a challenge from Asia’s richest man Mukesh Ambani in India— both in energy and transportation
Indians are heading back to parks, supermarkets and pharmacies — but malls and theatres are not on the priority list
Popular on BI
- Ethical Hacking and Cybersecurity
- EAM Jaishankar meets Australian Intelligence chief Andrew Shearer on sidelines of Raisina Dialogue
- Sustainable Tourism Practices
- Byju's shareholders vote to remove CEO, family; company calls vote invalid
- Engaging with competent authorities, use only genuine cheese, says McDonald's