Cyber alarm also raised for other grids

Warning came after mumbai incident, but there was no breach, says power ministry

Accusations of sabotage by Chinese malware agencies on India’s power grid started flying around after a report by Somerville-based cybersecurity firm Recorded Future. The Maharashtra government ordered an investigation into whether the Mumbai outage in October 2020 was in fact due to a Chinese sabotage.

Meanwhile, in response to a New York Times report, the Union ministry of power in a statement said an alarm was also raised on threat to Regional Load Dispatch Centres (RLDCS) and National Load Despatch Centre (NLDC), operated by Power Systems Operations Company (POSOCO) after the Mumbai incident, but it was resolved.

“An email was received from CERT-IN on 19th November, 2020 on the threat of malware called Shadow Pad at some control centres of POSOCO,” said the statement. CERT-IN or Indian Computer Emergency Response Team under the Ministry of Electronics and Information Technology is the nodal agency to deal with cybersecurity threats.

The power ministry further said the National Critical Information Infrastructure Protection Centre informed about the threat through a mail dated February 12, 2021. It stated: “Chinese state-sponsored threat actor group known as Red Echo is targeting Indian Power sector's RLDCS along with State Load Dispatch Centres (SLDCS)."

The ministry said following the reports, all IPS and domains listed in the emails were blocked in the firewall at all control centres and systems were scanned and cleaned by antivirus.

“Observations from all RLDCS & NLDC shows that there is no communication & data transfer taking place to the IPS mentioned. There is no impact on any of the functionalities carried out by POSOCO due to the referred threat. No data breach/data loss has been detected due to these incidents,” said the statement.

Cyber intelligence firm Recorded Future, in its latest report, said China-linked Group Redecho targeted the Indian power sector amid heightened border tensions. “Since early 2020, Recorded Future’s Insikt Group observed a large increase in suspected targeted intrusion activity against Indian organisations from Chinese state-sponsored groups,” the report said.

Recorded Future further said 10 Indian power sector organisations, including four of the five RLDC, are targets in a concerted campaign against India’s critical infrastructure.

Dinesh Waghmare, principal secretary of the state energy department, said on Monday, “We had asked Maharashtra cyber police to investigate the matter as there was suspicion of sabotage. The investigation is still on and they have not come to a conclusion as yet. Preventive measures will be taken.”