cyber.hendryadrian.com
Security Report · cloudsek.com

CloudSEK Warns of Hacktivist Attacks, Phishing and APT Activity Targeting India

· Original article ↗

Summary

CloudSEK reports coordinated hacktivist attacks, phishing scams and APT campaigns targeting Indian government, finance and other sectors around Independence Day, and advises users to verify sites, enable MFA and avoid suspicious offers.

Key points

  • CloudSEK reports hacktivist activity linked to geopolitical tensions, with groups coordinating across countries and targeting government, finance, healthcare, education and technology.
  • Its dataset records 1,114 data breaches, 656 DDoS attacks and 404 defacements; finance and banking were the most frequently targeted sectors.
  • Phishing sites impersonate Indian government portals and services to steal credentials; festival-themed fake offers circulated through WhatsApp are another expected scam.
  • APT36 is described as targeting Indian government and military entities with impersonation domains, spear-phishing and CapraRAT for credential theft and espionage.
  • SideCopy is reported to use spear-phishing, cross-platform RATs and credential theft; APT41 is reported to target Indian telecom, manufacturing, technology and finance.
  • CloudSEK advises checking website addresses, enabling MFA, avoiding unsolicited offers, protecting sensitive information and reporting scams to cybercrime.gov.in.

Article Details

Publisher
CloudSek
Scope
Recent cyber threats targeting India, including hacktivist campaigns, phishing and scams, and APT activity ahead of Independence Day.
Key Statistics
  • Finance and banking were reported as targets in over 4,000 incidents.
  • Government was reported as a target in over 800 incidents.
  • The article reports 404 defacement incidents, 656 DDoS attacks, and 1,114 data breaches.
Recommendations
  • Verify website addresses, including checking for subtle misspellings, before acting.
  • Enable multi-factor authentication on email, banking, and social media accounts.
  • Do not provide sensitive information such as Aadhaar numbers, CVVs, or passwords through unsecured email or SMS.
  • Verify urgent claims through an official app or website, and report suspicious activity to the Indian Cyber Crime Reporting Portal.

Threat Actors

APT 41Described as China-linked and reported to target Indian telecom, manufacturing, technology, and finance sectors.APT36Pakistan-nexus group reported to target Indian government and military websites.SideCopyReported to target Indian critical sectors with spear-phishing, cross-platform RATs, and credential-theft operations.Transparent TribeIdentified by the article as an alias of APT36.

Malware

CapraRATgathering from India's defense and government sectors. Additionally APT36 uses custom malware such as CapraRAT, often delivered via spear‑phishing emails, enabling persistent espionage against high‑value defense and

Vendors

CloudSEKCloudSEK’s flagship digital risk monitoring platform XVigil contains a module called “Underground Intelligence” which provides information about the latest Adversary, Malware, and Vulnerability Intelligence, gathered

Products

XvigilCloudSEK’s flagship digital risk monitoring platform XVigil contains a module called “Underground Intelligence” which provides information about the latest Adversary, Malware, and Vulnerability Intelligence, gathered

Countries

Bangladeshvast, interconnected global network of hacktivist groups. Our intelligence shows groups from Indonesia, Bangladesh, Pakistan, Turkey, and even the United States participating in coordinated campaigns against India. Chinawith spear-phishing, cross-platform RATs, and persistent credential-theft operations. Additionally, China-linked APT41 has expanded targeting to sectors including telecom, manufacturing, technology, and financeIndiaAs India celebrates its 79th Independence Day, the nation faces a highly organized and escalated cyber threat. This threat operates on two distinct fronts: on one hand, fueled by geopolitical tensions following theIndonesiaof a vast, interconnected global network of hacktivist groups. Our intelligence shows groups from Indonesia, Bangladesh, Pakistan, Turkey, and even the United States participating in coordinated campaigns againstPakistanglobal network of hacktivist groups. Our intelligence shows groups from Indonesia, Bangladesh, Pakistan, Turkey, and even the United States participating in coordinated campaigns against India. Turkeyglobal network of hacktivist groups. Our intelligence shows groups from Indonesia, Bangladesh, Pakistan, Turkey, and even the United States participating in coordinated campaigns against India. United Statesgroups. Our intelligence shows groups from Indonesia, Bangladesh, Pakistan, Turkey, and even the United States participating in coordinated campaigns against India. 

Industries

Educationa focus on economic disruption, the presence of government (over 800 incidents), healthcare, education and technology sectors demonstrates a desire to impact critical infrastructure and everyday life. Finance and bankingof hacktivist targets reveals a broad and strategic approach to their activism. While sectors like Finance and Banking are the most frequent targets (over 4,000 incidents), highlighting a focus on economic disruption,GovernmentPahalgam terror attack, hacktivist groups are openly forming alliances to target critical sectors like government, finance, and technology. On the other hand, opportunistic criminals are preparing widespread phishingHealthcarehighlighting a focus on economic disruption, the presence of government (over 800 incidents), healthcare, education and technology sectors demonstrates a desire to impact critical infrastructure and everydayManufacturingoperations. Additionally, China-linked APT41 has expanded targeting to sectors including telecom, manufacturing, technology, and finance in India, leveraging supply chain intrusions, zero‑day exploits, andMilitaryPakistan-nexus group APT36 (Transparent Tribe) has been actively targeting Indian government and military websites by registering new domain infrastructure that meticulously impersonates the Indian Army, DRDO,Technologyhacktivist groups are openly forming alliances to target critical sectors like government, finance, and technology. On the other hand, opportunistic criminals are preparing widespread phishing campaigns and fakeTelecommunications

Related Articles