Kudankulam Nuclear Power Plant · 2019-10
The Kudankulam Nuclear Power Plant incident involved malware on KKNPP's administrative network in India, with DTrack/Preft samples configured for information theft using victim-specific internal paths, credentials, compression of collected data, and attempted copying to an internal controller host. Multiple analyses linked the tooling and code overlaps to Lazarus-associated DTrack activity while noting the intrusion appeared aimed at reconnaissance and data collection rather than destructive impact on core industrial systems.
CSIS entry 673 · October 2019
India announced that North Korean malware designed for data extraction had been identified in the networks of a nuclear power plant.
Breach of the Kudankulam Nuclear Power Plant · 2019-10
Breach of the Kudankulam Nuclear Power Plant
https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/
Kudankulam Nuclear Power Plant · 2019-10-30
Nuclear Power Corporation of India Ltd (NPCIL) confirms that the network of a nuclear power plant was infected with malware. Several security researchers identify the malware as a version of DTrack, a backdoor trojan developed by the Lazarus Group.
Compromise of Indian nuclear power plant · Nov 2019
Devices on a noncritical administrative network in a nuclear power plant in Tamil Nadu, India, were compromised by DTrack, a remote access Trojan (RAT) associated with the
Kudankulam Nuclear Power Plant · 2019-10
Reported: 2019-10; Victims: Kudankulam Nuclear Power Plant; Motivations: Espionage; Sectors: Utility; Countries: India
North Korean malware found in IT networks of Indian power plants · (not dated; in context of 2019)
North Korean malware has been found in the IT networks of Indian power plants
4th November – Threat Intelligence Bulletin · 2019-11-04
India’s nuclear power plant has been hit by a cyber-attack after malware designed for data extraction was identified in one of its systems. The malware, linked by experts to the North-Korean group Lazarus, infected a computer in the plant’s external network, rather than the operational one.
Nuclear Power Corporation of India Ltd (NPCIL) · 30/10/2019
Nuclear Power Corporation of India Ltd (NPCIL) confirms that the network of a nuclear power plants was infected with malware. Several security researchers identify the malware as a version of DTrack, a backdoor trojan developed by the Lazarus Group.
'No cyber attack on Kudankulam nuclear plant systems' · 2019-10-30
attribution sentence(s): Several users on Twitter claimed that a data dump on VirusTotal, a virus tracking website, suggested that Lazarus, the North Korea-based hacker group, might have gained access to some of the systems at KKNPP.
North Korean virus Dtrack targets nuclear plant in Kudankulam - what we know so far · 2019-10-31
attribution sentence(s): New Delhi: After first denying any malware attack, the Nuclear Power Corporation of India (NPCIL) on Wednesday confirmed the presence of malware in its system at the Kudankulam nuclear plant, which has been traced to North Korea's Dtrack. | Several security researchers identified the malware as a version of Dtrack, a backdoor trojan developed by the Lazarus Group, North Korea's elite hacking unit. | Arstechnica.com, quoting Kaspersky Lab said, said in a recent article on Dtrack: "North Korea's hermit government has developed a new strain of malware that steals data used at automatic teller machines in India".
India: Nuclear plant hacking - what you need to know · 2019-06-23
attribution sentence(s): Did North Korea launch the attack? | Some researchers suggest that the KKNPP attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. | India maintains good diplomatic and economic relations with North Korea, so if Pyongyang did sponsor the attack, expect a diplomatic fallout.
Did North Korean Hackers Attack India's Kudankulam Nuclear Power Plant? · 2019-10-31
attribution sentence(s): The malware is suspected to have originated in North Korea | For those unaware, Dtrack is a virus used by North Korea-based hacker group Lazarus.
Indian Space Research Organization and Kudankulam Nuclear Power Plant (DTrack) · September and October 2019
Para 119: “The Panel noted reports that, in September and October 2019, the Indian Space Research Organization and the Kudankulam Nuclear Power Plant, India, received cyberattacks using DTrack malware, which was developed by the Lazarus Group. The Panel investigated the attacks as possible violations of the provisions of the arms embargo through cybermeans. Investigations continue.”
Kudankulam Nuclear Power Plant (DTrack)
Para 117: “Responding to the Panel’s inquiry into the attacks against the Kudankulam Nuclear Power Plant, India conveyed the information from its relevant agencies that the malware used to attack the nuclear plant had been identified as “DTrack”, a malware reportedly used by Lazarus, and informed the Panel that the malware was being further analysed. Investigations continue.”