One analyst called it an act of war.
Nuclear Option
After denying reports of a system malware infection Tuesday, the Nuclear Power Corporation of India Limited (NPCIL) admitted yesterday that it had indeed been hacked.
"Identification of malware in NPCIL system is correct," read a Wednesday statement. "The matter was conveyed by CERT-In [India's national computer emergency response team] when it was noticed by them on September 4, 2019."
Big Hack
The hack represents yet another example of broad infosec vulnerabilities in critical power systems. Hacker groups have previously infiltrated power grids in Europe and North America in the past. In 2017, hackers targeted nuclear facilities in the U.S. as well.
"The investigation revealed that the infected PC belonged to a user who was connected in the internet connected network for administrative purposes," the statement read. It also claimed the hack was "isolated from the critical internal network," and that plant systems were not affected.
North Korean Malware
The malware identified as a version of "Dtrack," which is backdoor trojan software reportedly developed by the Lazarus Group, North Korea's state-owned hacking unit. It was first discovered by the Kaspersky Global Research and Analysis Team in September and can be used to upload and download files to target systems.
And there may other targets as well. Threat analyst Pukhraj Singh, who reported the breach to India's National Cyber Security Coordinator, called the malware attack a "casus belli" — an act of war — in an interview with Ars Technica thanks to a still unknown "second target, which I can't disclose as of now."
READ MORE: Indian nuclear power plant’s network was hacked, officials confirm [Ars Technica]
More on power grid hacks: A Dangerous Cyberattack On A Petrochemical Plant Could Be The First Of Many
Share This Article