Suspected state-sponsored Chinese hackers have targeted the power sector in India in recent months as part of an apparent cyber-espionage campaign, the threat intelligence firm Recorded Future Inc. said in a report published on Wednesday.
The hackers focused on at least seven “load dispatch” centers in northern India that are responsible for carrying out real-time operations for grid control and electricity dispersal in the areas they are located, near the disputed India-China border in Ladakh, the report said.
One of the load dispatch centers previously was the target of another hacking group, RedEcho, which Recorded Future has said shares “strong overlaps” with a hacking group that the U.S. has tied to the Chinese government.
''In recent months, we observed likely network intrusions targeting at least seven Indian State Load Despatch Centres (SLDCs) responsible for carrying out real-time operations for grid control and electricity dispatch within these respective states. Notably, this targeting has been geographically concentrated, with the identified SLDCs located in North India, in proximity to the disputed India-China border in Ladakh," the group said.
"In addition to the targeting of power grid assets, we also identified the compromise of a national emergency response system and the Indian subsidiary of a multinational logistics company by the same threat activity group," it said.
Recorded Future said they alerted the government of their findings before publishing the report.
According to the intelligence firm, considered to be among the world's largest with a specialisation in identifying threats from state-sponsored hackers, the Chinese attackers were trying to gather information surrounding critical infrastructure systems.
The discovery is the latest example of how the conspicuous placement of malware in an adversary’s electric grid or other critical infrastructure has become the newest form of both aggression and deterrence — a warning that if things are pushed too far, millions could suffer.
Both India and China maintain medium-size nuclear arsenals, which have traditionally been seen as the ultimate deterrent. But neither side believes that the other would risk a nuclear exchange in response to bloody disputes over the Line of Actual Control, an ill-defined border demarcation where long-running disputes have escalated into deadly conflicts by increasingly nationalistic governments.
Cyberattacks give them another option — less devastating than a nuclear attack, but capable of giving a country a strategic and psychological edge. Russia was a pioneer in using this technique when it turned the power off twice in Ukraine several years ago.
And the United States has engaged in similar signaling. After the Department of Homeland Security announced publicly that the American power grid was littered with code inserted by Russian hackers, the United States put code into Russia’s grid in a warning to President Vladimir Putin.
“The prolonged targeting of Indian power grid assets by Chinese state-linked groups offers limited economic espionage or traditional intelligence gathering opportunities,” the Recorded Future report states. “We believe this is instead likely intended to enable information gathering surrounding critical infrastructure and/or pre-positioning for future activity.”
In addition, the hackers compromised an Indian national emergency response system and a subsidiary of a multinational logistics company, according to the report.
