Cybersecurity experts have said that the cyberattack on India’s Kudankulam nuclear power plant should come as “no surprise” given the high-value of critical infrastructure and India’s geopolitical position.
The Nuclear Power Corporation of India Limited (NPCIL), which runs 22 commercial nuclear power reactors in the nation, confirmed yesterday that malware had been found in the system but said it was “isolated from the critical internal network”.
Go deeper with GlobalData
Some cybersecurity experts have disputed this claim.
“In some respects, it’s reassuring that the attackers did not reach the plant’s control systems, but it’s a stark reminder that safety and cybersecurity go hand-in-hand these days,” said Dave Weinstein, CSO at Claroty, a cybersecurity firm that specialises in protecting operational technology.
“Organisations can no longer rely on the so-called ‘air gap’ to secure their control systems; they must perform continuous security monitoring.”
The malware is believed to be Dtrack, which cybersecurity firm Kaspersky previously identified as being used to target banks and research centres in India.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“Dtrack malware may usually be used for reconnaissance purposes but the information gathered from infected industrial and critical infrastructure plants could be used for other malicious purposes,” said Andrea Carcano, co-founder and CPO at Nozomi Networks.
Dtrack is associated with North Korea-based hacking group Lazarus, which has carried out previous hacking campaigns against India.
Nuclear power plant cyberattack: India an economic and political target
The India power station cyberattack is a reminder that critical national infrastructure is a “lucrative target” for hackers, said Stuart Reed, vice president of cyber at Nominet.
“Not only can an attack disrupt services that have a nationwide impact but data is often highly sensitive and valuable,” he said.
“The attack on India’s nuclear power plant is particularly worrying given it should have had the newest and most secure network. It is fundamental that those responsible for the provision of critical infrastructure are taking the necessary steps to defend themselves from attackers.”
Virus scanner Virus Total, owned by Alphabet, first identified the hack, which Indian officials have reportedly known about since September.
Sam Curry, chief security officer at Cybereason, said: “It should come as no surprise that India is both a target for political and economic reasons, or that it is a major player, ready-or-not, in the cyber arena too.
“What this discovery does is reinforce how complex the world of espionage, cybercrime and nation-state hacking is. India has offensive and defensive cyber capabilities, is a nuclear power, has a massive percentage of the world’s population, the largest middle class in the world and the world’s largest democracy,” he said.
Curry added: “It is strategic and has deep ties with the leading economies like the USA. That makes India a massive part of the geopolitical landscape and by extension of the cyber landscape. It’s time for India to step up activities, and it’s time for a new alignment and balance of power in the cyber domain to match what we do in others: land, sea, air, space.”
Cybersecurity experts called for a layered approach to security and for continuous monitoring to identify suspicious traffic before an attack takes place.
“It is imperative that critical infrastructure organisations put plans in place to prevent malicious attacks, and the cybersecurity community comes together to share expertise and knowledge on identifying and providing solutions to cybersecurity challenges,” added Carcano.
Read more: Georgia cyberattack has hallmarks of nation-state attack
