North Korean hackers allegedly targeted Indian space agency

The Dtrack malware infection successfully disrupted an active lunar mission

Rocket blasting off to Mars

At least five critical Indian government agencies have been reportedly targeted by North Korean hackers in recent months, including its atomic regulatory board and space agency.

The Indian Space Research Organisation (ISRO) was alerted by a US cyber security company to a potential malware breach in early September, according to the Indian Express. The alert suggested that cyber criminals had infiltrated master 'domain controllers' at the Kudankulam nuclear power plant and the ISRO using the same malware strain.

The incident also may have had an effect on a failed lunar landing mission, Chandrayaan 2, which was due to touch down approximately 100 hours after the attack struck, sources who spoke with the newspaper said.

This mission was due to make a soft-landing on the Moon's South Pole on 7 September but lost contact with the earth station.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

India's National Cyber Coordination Centre, similar in nature to the UK's National Cyber Security Centre (NCSC), was tipped off on 3 September about the attacks, with the power plant breach becoming public knowledge just last week.

The attackers were among at least five launched against India's critical national infrastructure, according to the founder of cyber security firm Security Brigade Yash Kadakia, speaking with the FT.

The malware strain itself was identified as Dtrak, which could allow cyber criminals to gain control over any and all infected devices. The 'domain controllers' targeted were server computers that responded to security authentication requests.

The Kudankulam plant initially said no cyber attack on its systems were possible, but the Nuclear Power Corporation of India which runs the plant conceded later that an infection had spread into the administrative network.

People within the respective agencies are reported to have opened phishing emails that were sent by the hackers, which led to the malware infiltrating agency systems.

Dtrack has been associated with activity by the Lazarus group, Kaspersky's SecureList platform suggests. The Lazarus Group has, in turn, been previously associated with the North Korean state.

Advertisement - Article continues below

A variation of the strain was last used on a widespread scale in 2018 in the form of a banking malware that targeted Indian banks. Analysis by Kaspersky showed the malware was designed to be planted on ATMs, where it could read and store information from cards inserted into the individual machines.

This attack may have been part of its 'FASTCash' scheme, identified by Symantec, through which Lazarus aimed to steal millions of dollars from ATMs across the world.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/hardware/laptops/354533/dell-xps-13-new-9300-hands-on-review-chasing-perfection
Laptops

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020