US company identifies Chinese malware targeting Indian power assets

US-based Recorded Future’s Insikt Group has identified Chinese malware RedEcho targeting 10 state-run Indian power generation and transmission assets and two ports, its CEO and co-founder Christopher Ahlberg told mediapersons on Thursday. He, however, said there was no data to substantiate that last year’s Mumbai power outage in October was part of the cyberattack by the China-linked group.

He said the attacks were unusual because of their scale and unsettling as they targeted civilian infrastructure.

The targeted assets include load despatch centres of eastern, north eastern, southern and western regions besides state load despatch centres of Delhi and Telengana. NTPC’s Kudgi power plant in Karnataka, Mumbai Port Trust, V O Chidamabarnar Port and a substation were also targeted, the report alleged.


Ahlberg said the targeting of these organisations, all run by state entities, poses significant concerns over potential pre-positioning of network access to support Chinese strategic objectives.

“The impact of a cyberattack targeting the critical infrastructure of a country, whether for espionage or malicious activity, has the potential to be catastrophic with long-term repercussions. We have long seen cyber efforts from China aimed around strategic policies and initiatives, and this campaign from RedEcho is no exception. Accurate and actionable intelligence is vital for pre-empting such attacks and proactively disrupting adversaries both within an organisation and across a nation,” Ahlberg said.