Pak-based hackers targeting critical infrastructure PSUs in India

Pakistanbased hacker groups have expanded their cyberattack network in India and are now targeting highprofile targets from critical infrastructure PSUs from telecom power and finance sectors in the country a new report warned on FridayIn October 2020 reports surfaced that Pakbased Advanced Persistent Threat APT groups targeted Indian defence unitsThe new findings from cyber security firm Seqrite have revealed that active since 2019 the APT Operation SideCopy appears to be a cyber espionage campaign by Pakistanbacked Transparent Tribe group that is now targeting critical infrastructure PSUs in IndiaFurther investigation of the IP using data from whatismyipaddresscom revealed that the provider of that IP address is Pakistan Telecommunication Company Limited This revelation further strengthens the claim that Operation SideCopy which is operated by the Transparent Tribe group is originating in Pakistan the researchers informedAlso read Brazen online scamster targets senior cop creates his fake profile on FacebookThis is likely only a subset of targets since there are several other commandandcontrol C2 servers being used in Operation SideCopy APT which are probably targeting other entities they addedSeqrite researchers have proactively alerted the government authorities and are working with them to keep potential targets safeResearchers suspect this attack to be a cyberespionage campaign aimed at collecting sensitive information to gain a competitive advantage against IndiaThe evidence gathered by Seqrite suggests a highly organised operation designed to evade most security mechanisms As part of the campaign attackers are sending out phishing emails with governmentthemed documents in an attempt to lure targets into opening the attachments the company emphasisedAccording to Seqrite threat actors were leveraging compromised websites which resemble the websites that the targeted organisations would generally accessFurther analysis of data accessible from some C2 servers led researchers at Seqrite to an IP address that was commonly found across different C2 serversIn fact this IP address turned out to be the first entry in many logs which indicated that the corresponding system is likely being used for testing the attack before launch the team notedAccording to researchers the malicious actors have enhanced the attack tools and methods as compared to last year to make detection difficultThis attack group is well funded and is actively improving its attack mechanisms to infiltrate the target entities The group can potentially steal critical intel from the government agencies and their subsequent bodies the report mentionedThey can even use that information to make more lures and target other government departments warned researchers from Seqrite the cybersecurity security products and solutions brand of Quick Heal Technologies LimitedThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever