The Nuclear Power Corporation of India Limited (NPCIL), which runs 22 commercial nuclear power reactors in the nation, confirmed yesterday that malware had been found in the system but said it was “isolated from the critical internal network”.
Some cybersecurity experts have disputed this claim.
“In some respects, it’s reassuring that the attackers did not reach the plant’s control systems, but it’s a stark reminder that safety and cybersecurity go hand-in-hand these days,” said Dave Weinstein, CSO at Claroty, a cybersecurity firm that specialises in protecting operational technology.
“Organisations can no longer rely on the so-called ‘air gap’ to secure their control systems; they must perform continuous security monitoring.”
The malware is believed to be Dtrack, which cybersecurity firm Kaspersky previously identified as being used to target banks and research centres in India.
“Dtrack malware may usually be used for reconnaissance purposes but the information gathered from infected industrial and critical infrastructure plants could be used for other malicious purposes,” said Andrea Carcano, co-founder and CPO at Nozomi Networks
Dtrack is associated with North Korea-based hacking group Lazarus, which has carried out previous hacking campaigns against India.
Nuclear power plant cyberattack: India an economic and political target
The India power station cyberattack is a reminder that critical national infrastructure is a “lucrative target” for hackers, said vice president of cyber at NominetStuart Reed.
“Not only can an attack disrupt services that have a nationwide impact but data is often highly sensitive and valuable,” he said.
“The attack on India’s nuclear power plant is particularly worrying given it should have had the newest and most secure network. It is fundamental that those responsible for the provision of critical infrastructure are taking the necessary steps to defend themselves from attackers.”
Virus scanner Virus Total, owned by Alphabet, first identified the hack, which Indian officials have reportedly known about since September.
Sam Curry, chief security officer at Cybereason, said: “It should come as no surprise that India is both a target for political and economic reasons, or that it is a major player, ready-or-not, in the cyber arena too.
“What this discovery does is reinforce how complex the world of espionage, cybercrime and nation-state hacking is. India has offensive and defensive cyber capabilities, is a nuclear power, has a massive percentage of the world’s population, the largest middle class in the world and the world’s largest democracy,” he said.
Curry added: “It is strategic and has deep ties with the leading economies like the USA. That makes India a massive part of the geopolitical landscape and by extension of the cyber landscape. It’s time for India to step up activities, and it’s time for a new alignment and balance of power in the cyber domain to match what we do in others: land, sea, air, space.”
Cybersecurity experts called for a layered approach to security and for continuous monitoring to identify suspicious traffic before an attack takes place.
“It is imperative that critical infrastructure organisations put plans in place to prevent malicious attacks, and the cybersecurity community comes together to share expertise and knowledge on identifying and providing solutions to cybersecurity challenges,” added Carcano.
