Hacker group hacked Indian Nuclear power plant and ISRO

Authorities don’t seem to understand the real threat from cyber-operations.

It is now evident that both the Kudankulam Nuclear Power Plant  (KNPP) and the Indian Space Research Organisation (ISRO), were the target of a cyber-attack. 

The nuclear power plant’s administrative network was breached in the attack but did not cause any critical damage. 

KKNPP  plant officials had initially denied suffering an attack and officially stated that KKNPP “and other Indian Nuclear Power Plants Control Systems are stand-alone and not connected to outside cyber networks and the Internet. Any Cyberattack on the Nuclear Power Plant Control System is not possible.” 

So what really happened at Kudankulam? Here’s what you need to know.

1. The nuclear power plant and the cyberattack

The KKNPP is the biggest nuclear power plant in India, equipped with two Russian-designed and supplied VVER pressurized water reactors with a capacity of 1,000 megawatts each. According to the NPCIL statement, the malware attack on KKNPP was noticed Sept. 4 by the CERT-In (Indian Computer Emergency Response Team), which is the national agency for responding to cybersecurity incidents.

VirusTotal, a virus scanning website owned by Google’s parent company, Alphabet, has indicated that a large amount of data from the KKNPP’s administrative network has been stolen. If this is true, subsequent attacks on the nuclear power plant could target its critical systems more effectively. Cyberattacks on nuclear power plants could have physical effects, especially if the network that runs the machines and software controlling the nuclear reactor is compromised.

2. Isolating the computer network from the Internet won’t protect against a targeted attack

In its initial denial, the NPCIL stated, “Any cyberattack on the Nuclear Power Plant Control System is not possible.” The KKNPP site director went on record stating that “the totally isolated network of KKNPP could not be accessed by any outside network from any part of the globe. Hence there was no question of it being hacked.” Even the second NPCIL statement emphasizes that “the critical internal network” was isolated from the administrative one, and by implication, the Internet.

3. Did North Korea launch the attack?

Some researchers suggest that the KKNPP attack was caused by a variant of the DTRACK virus, developed by the North Korea-linked Lazarus group. The NPCIL has not challenged these claims. India maintains good diplomatic and economic relations with North Korea, so if Pyongyang did sponsor the attack, expect a diplomatic fallout.

4. Could such attacks lead to military escalation?

While the Kudankulam attack did not cause any critical systems damage or, apparently, affect the reactors, it revealed that India’s cyber-defenses are based on outdated principles like the air gap strategy. NPCIL officials’ early denials suggested a sense of complacency about cyberdefense, which means India’s critical infrastructure is vulnerable to attack.

Cyberattacks can increase the risk of military escalation. Since the recent Kashmir crisis, there has been a rise in cyberattacks from Pakistan in India. Indians have also been responding with their own cyber operations against Pakistan. Given the low threshold of military escalation between India and Pakistan and a high potential for escalation from cyber to the real world, India may wish to treat the Kudankulam attack as a wake-up call about its vulnerable cyber defenses at nuclear facilities and other critical infrastructure.