After a report released by threat research division of Massachusetts-based Recorded Future, which claimed that suspected Chinese hackers had attacked power load dispatch centres near Ladakh that are responsible for carrying out real-time operations for grid control and electricity dispersal in the areas surrounding the disputed India-China border, the Centre on Thursday confirmed the attacks but claimed they were foiled. The attacks took place between August last year and March.
Union Power Minister RK Singh said two attempts were made by state-backed Chinese hackers who aimed to target electricity distribution grid centres, but were not successful. “... We've already strengthened our defence system to counter such cyber attacks," Singh added.
The investigation found the data passing in and out of state Load Despatch Centres to the Chinese state-sponsored command and control servers spread across the world.
The report said that it has collected evidence that hackers targeted seven Indian state centers responsible for carrying out electrical dispatch and grid control near a border area disputed by the two nuclear neighbors. It has reported on intrusion activity targeting operational assets within India's power grid in February 2021. This was attributed to a likely Chinese state-sponsored threat activity group by the cyber security firm.
A map of targeted power infrastructure released by the group illustrated rough locations concentrated in northern India.
''Given the continued targeting of State and Regional Load Despatch Centres in India over the past 18 months, first from RedEcho and now in this latest TAG-38 activity, this targeting is likely a long-term strategic priority for select Chinese state-sponsored threat actors active within India," it said.
The group primarily used the trojan ShadowPad, which is believed to have been developed by contractors for China’sMinistry of State Security, leading to the conclusion that this was a state-sponsored hacking effort, the group reported.
“ShadowPad continues to be employed by an ever–increasing number of People’s Liberation Army and Ministry of State Security-linked groups, with its origins linked to known MSS contractors first using the tool in their own operations and later likely acting as a digital quartermaster,” Recorded Future said in the report. According to the intelligence firm, considered to be among the world's largest with a specialisation in identifying threats from state-sponsored hackers, the Chinese attackers were trying to gather information surrounding critical infrastructure systems.
The Recorded Future group said they alerted the government of their findings before publishing the report.