Malware has been the most common gateway for hackers to infiltrate computer systems. Using various manipulation, bad actors can trick unsuspecting victims into clicking/downloading/installing something, that will in turn introduce the malware into their computer.
The same was experienced by the Kudankulam nuclear power plant, which is under the governance of Nuclear Power Corporation of India (NPCIL), a government-owned entity responsible for nuclear power in the country.
After NPCIL initially denying that the power plant suffered any malware infection, issuing a statement to describe the report as "false information," and that a cyberattack on the power plant was "not possible", the facility finally admitted that its systems have indeed been breached.
The facility was aware of the incident when it was notified by the Indian Computer Emergency Response Team (CERT-IN) on September 4th.
After a thorough investigation by specialists at India's Department of Atomic Energy, the result revealed the the source of infection came from a PC belonged to a user who was connected in the facility's internet-connected network used for administrative purposes.
Fortunately, this network is continuously monitored and isolated from the critical internal network.
As a result, the investigation confirmed that the nuclear power plant's control systems remained intact
While the infection only occurred on one of the administrative computer, it was speculated that the malware is the same as that Dtrack malware used by North Korea's Lazarus hacking group to target Indian ATM systems in September.
The attack used malware to access the domain controller account that grants access and authenticates requests from other computers in the network.
A report by Indian Express said that the National Cyber Security Council (NCSC) formed a committee that visited the site mid-September, and submitted an advisory this October to the KKNPP officials.
According to security firm Kaspersky that previously analyzed this malware, the malware has features for:
- Keylogging.
- Retrieving browser history.
- Gathering host IP addresses, information about available networks and active connections.
- Listing all running processes.
- Listing all files on all available disk volumes.
While the facility's critical systems weren't affected, the incident shows how a malware designed to hack ATM machines can also be used to gain administrator access to systems of a nuclear power plant. Beside hacking ATMs, Dtrack samples have also been spotted in politically-motivated cyber-espionage operations.
As evident from its features, Dtrack is usually used for reconnaissance purposes. and also as a dropper for other malware payloads.
But in the India's nuclear facility's case, the hackers might not be able to manipulate control systems, especially because the network the infected computer was at, was isolated. But still, the leveraged privilege the hackers can get using the malware, could have allowed them to steal data from other computers on that isolated network.
This also highlights how the nuclear power plant lacked the adequate security measures for computer systems in the first place.
Kudankulam nuclear power plant is the single largest nuclear power station in India, located in Koodankulam in the Tirunelveli district of the southern Indian state of Tamil Nadu. At the time of the breach, KNNP's 1 unit 1 and 2 were operating at a capacity of 1,000 MW and 600 MW of electricity, respectively.
