China-linked hackers target Indian port

At least one connection opened by the hackers into the network system of an unnamed Indian port is still active according to US firm Recorded Future, said Dryad Global. Stuart Solomon, the company’s chief operating officer said as of 2 March, Recorded Future could see a ‘handshake’ — indicating an exchange of traffic — between a China-linked group it calls ‘RedEcho’ and an Indian maritime port.

The activity has been revealed by Recorded Future’s Insikt Group, the company’s threat research arm. Recorded Future said RedEcho had targeted as many as 10 entities under India’s power grid as well as two maritime ports when the company first notified India’s Computer Emergency Response Team on 10 February. Most of these connections were still operational as recently as 28 February, Mr Solomon said.

“There’s still an active connection between the attacker and the attackee,” Mr Solomon said, referring to the port. “It’s still happening.”

No confirmation

A spokesman for India’s ministry of electronics and information technology wasn’t immediately available for comment, said Dryad Global. “Without any proof, slandering a specific side is irresponsible behavior and an ill-intentioned one,” Chinese foreign ministry spokesman Wang Wenbin said in Beijing on 3 March.

The intrusions into India’s critical infrastructure have been occurring since at least the middle of last year, according to Recorded Future, which tracks back to the start of a bloody skirmish between Indian and Chinese soldiers at a border post in the Himalayas.

Since then, authorities across India’s federal and state governments have been bickering about whether a cyberattack was responsible for the October collapse of the power grid that supplies Mumbai, an outage that brought the financial hub to a halt for several hours, impacting stock markets, transport networks and thousands of households.