Indian Critical Infrastructure Intrusions
Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly RedEcho and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.[1][2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1583 | .001 | Acquire Infrastructure: Domains |
During Indian Critical Infrastructure Intrusions, RedEcho registered domains spoofing Indian critical infrastructure entities.[1] |
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
During Indian Critical Infrastructure Intrusions, RedEcho network activity included SSL traffic over TCP 443 and HTTP traffic over non-standard ports.[1] |
| Enterprise | T1584 | Compromise Infrastructure |
Indian Critical Infrastructure Intrusions included the use of compromised infrastructure, such as DVR and IP camera devices, for command and control purposes in ShadowPad activity.[2] |
|
| Enterprise | T1568 | Dynamic Resolution |
During Indian Critical Infrastructure Intrusions, RedEcho used dynamic DNS domains associated with malicious infrastructure.[1] |
|
| Enterprise | T1573 | .002 | Encrypted Channel: Asymmetric Cryptography |
During Indian Critical Infrastructure Intrusions, RedEcho used SSL for network communication.[1] |
| Enterprise | T1599 | Network Boundary Bridging |
Indian Critical Infrastructure Intrusions involved the use of FRP to bridge network boundaries and overcome NAT.[2] Indian Critical Infrastructure Intrusions also involved the use of VPN tunnels with a potentially compromised MSP entity allowing for direct access to critical infrastructure entity networks.[3] |
|
| Enterprise | T1571 | Non-Standard Port |
During Indian Critical Infrastructure Intrusions, RedEcho used non-standard ports such as TCP 8080 for HTTP communication.[1] |
|
| Enterprise | T1588 | .004 | Obtain Capabilities: Digital Certificates |
Indian Critical Infrastructure Intrusions included the use of digital certificates spoofing Microsoft.[2] |
Software
| ID | Name | Description |
|---|---|---|
| S1144 | FRP |
Indian Critical Infrastructure Intrusions included the use of FRP to enable remote access.[2] |
| S0596 | ShadowPad |
Indian Critical Infrastructure Intrusions included the use of ShadowPad malware for operations.[2][3] |
References
- Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.
- Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.