Indian Critical Infrastructure Intrusions

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly RedEcho and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.(Citation: RecordedFuture RedEcho 2021)(Citation: RecordedFuture RedEcho 2022)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2021-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2021-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-04-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1584 · Compromise Infrastructure

  Resource Development — Indian Critical Infrastructure Intrusions included the use of compromised infrastructure, such as DVR and IP camera devices, for command and control purposes in ShadowPad activity.(Citation: RecordedFuture RedEcho 2022)

• T1583.001 · Domains

  Resource Development — During Indian Critical Infrastructure Intrusions, RedEcho registered domains spoofing Indian critical infrastructure entities.(Citation: RecordedFuture RedEcho 2021)

• T1588.004 · Digital Certificates

  Resource Development — Indian Critical Infrastructure Intrusions included the use of digital certificates spoofing Microsoft.(Citation: RecordedFuture RedEcho 2022)

• T1071.001 · Web Protocols

  Command And Control — During Indian Critical Infrastructure Intrusions, RedEcho network activity included SSL traffic over TCP 443 and HTTP traffic over non-standard ports.(Citation: RecordedFuture RedEcho 2021)

• T1568 · Dynamic Resolution

  Command And Control — During Indian Critical Infrastructure Intrusions, RedEcho used dynamic DNS domains associated with malicious infrastructure.(Citation: RecordedFuture RedEcho 2021)

• T1599 · Network Boundary Bridging

  Defense Impairment — Indian Critical Infrastructure Intrusions involved the use of FRP to bridge network boundaries and overcome NAT.(Citation: RecordedFuture RedEcho 2022) Indian Critical Infrastructure Intrusions also involved the use of VPN tunnels with a potentially compromised MSP entity allowing for direct access to critical infrastructure entity networks.(Citation: Dragos YIR 2021)

• T1573.002 · Asymmetric Cryptography

  Command And Control — During Indian Critical Infrastructure Intrusions, RedEcho used SSL for network communication.(Citation: RecordedFuture RedEcho 2021)

• T1571 · Non-Standard Port

  Command And Control — During Indian Critical Infrastructure Intrusions, RedEcho used non-standard ports such as TCP 8080 for HTTP communication.(Citation: RecordedFuture RedEcho 2021)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0043

  Official MITRE ATT&CK campaign record C0043. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.