Security News > 2022 > April > Chinese Hacker Groups Continue to Target Indian Power Grid Assets

China-linked adversaries have been attributed to an ongoing onslaught against Indian power grid organizations, one year after a concerted campaign targeting critical infrastructure in the country came to light.

Most of the intrusions involved a modular backdoor named ShadowPad, according to Recorded Future's Insikt Group, a sophisticated remote access trojan which has been dubbed a "Masterpiece of privately sold malware in Chinese espionage."

The 2021 RedEcho attacks involved the compromise of 10 distinct Indian power sector organizations, including six of the country's regional and state load despatch centres, two ports, a nation power plant, and a substation.

Recorded Future linked the latest set of malicious activities to an emerging threat cluster it's tracking under the moniker Threat Activity Group 38 aka TAG-38, citing "Notable distinctions" from that of the previously identified RedEcho TTPs. In addition to attacking power grid assets, TAG-38 impacted a national emergency response system and the Indian subsidiary of a multinational logistics company.

"The use of ShadowPad across Chinese activity groups continues to grow over time, with new clusters of activity regularly identified using the backdoor as well as continued adoption by previously tracked clusters," the researchers said, adding it's monitoring at least 10 distinct groups with access to the malware.

"Recently, Chinese cybersecurity companies released a series of reports, revealing that the U.S. government launched cyber attacks on many countries around the world, including China, seriously jeopardizing the security of critical infrastructure of these countries," China's Foreign Ministry spokesperson, Zhao Lijian, said.

News URL

https://thehackernews.com/2022/04/chinese-hacker-groups-continue-to.html