Tag: india
-
India Warns of New AI-Driven Cyber-Attacks Targeting Financial and Crypto Businesses
The Indian CERT said a new cyber malicious group tracked as ‘Crafty Flacon’ is using Chinese-made AI tools to attack fintech and crypto organizations First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/india-warns-ai-cyberattacks/
-
CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access
The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools First seen…
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
PapRAT Cyber Espionage Campaign Leaves a ‘BITTER’ Taste in South Asia
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
MR ROBOT Malware-as-a-Service Targets Indian Bank Customers
MR ROBOT Android malware rents banking trojans that steal one-time passwords and card data First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/robot-malware-indian-bank-customers/
-
CyberDakait Hackers Target Indian Banking Users, Compromise 17,960 Android Devices
CyberDakait, a financially motivated Android malware operation targeting Indian banking customers since July 2025. Researchers identified at least 17,960 compromised devices and 7,611,443 intercepted SMS messages, exposing a campaign that combines banking credential theft, remote device control, and cryptocurrency mining. Although their technical implementations differ, Group-IB clusters them together because of overlapping distribution methods, phishing…
-
Microsoft Whistleblower Claims Foreign Engineers Can Access Sensitive U.S. Government Cloud Systems
An alleged Microsoft whistleblower has raised concerns regarding overseas engineers accessing U.S. government cloud information through the company’s >>escort<< support process. Screenshots mentioned in an October 28 post by the X account Conspiracookie allegedly show approval for an engineer based in India to view logs associated with Microsoft's Government Community Cloud (GCC). However, these claims…
-
WhatsApp and Telegram May Stop Working Without Registered SIM Cards From January 1, 2027
WhatsApp and Telegram users in India may face access restrictions starting January 1, 2027, as messaging platforms implement the government’s SIM-binding requirements. The Department of Telecommunications (DoT) has set December 31, 2026, as the compliance deadline, requiring messaging services to keep accounts linked to the active SIM associated with the registered mobile number. These changes…
-
SBI Notifies Customers Affected by Recent Cybersecurity Incident
The State Bank of India (SBI) has individually notified customers whose data was involved in a recent cybersecurity incident. In an update focused on customer safety, the bank confirmed it contacted affected individuals via email and/or WhatsApp. They reassured customers that their account balances and funds are safe. This announcement follows an earlier communication about…
-
PwC Allegedly Hit by Everest Ransomware Group, 590GB of Data Stolen
The Everest ransomware group has reportedly stolen around 590GB of data linked to PwC, one of the Big Four professional services firms. The claim concerns internal human resources and learning systems, but it remains unverified, as no independent reports have confirmed it. A post shared by Crypto India states that the alleged theft includes 108,426…
-
Hacker Turned DeepSeek Into an AI Cybercrime Assistant to Attack Universities and Steal Data
A threat actor using the handle BUGSTER configured DeepSeek V4 as the reasoning engine for an AI-assisted cybercrime operation that targeted organizations in India, including universities. Unit 42, Palo Alto Networks’ threat-intelligence team, says the actor used AI-generated reconnaissance and scripts to brute-force a university website and successfully stole a database containing more than 5,200…
-
State Bank of India Suffers a Customer PII Data Leak
Relatively small data breaches in India can turn quite serious, thanks to a sophisticated underground market for trading PII. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/state-bank-india-customer-pii-data-leak
-
Indian tech company eMudhra announces withdrawal from certificate business after security incident
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company’s private keys was just the number four. First seen on therecord.media Jump to article: therecord.media/indian-tech-company-announces-withdrawal-certificate-business-incident
-
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates.eMudhra said it will replace affected customers’ certificates with free ones from partners, though its First seen…
-
Weak Certificates From Indian CA Cause Cascade of Updates
eMudhra Says It Mistakenly Used Weak Certificates to Sign 8 Intermediary Certs. An Indian certificate authority revoked intermediate certificates after a researcher found it used a private encryption key that was only one byte in length, making it trivial for hackers to recover the key and issue their own fraudulent certs. The issue has the…
-
eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/emudhra-certificates-private-keys-compromised/
-
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.The state-owned bank, India’s largest, said in a stock-exchange filing dated October 21 that it “has experienced an incident involving the…
-
Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Google, Mozilla, Apple, the Go project and others moved swiftly to block the affected certificates from the Indian CA, though it’s unclear how the keys were compromised. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys
-
SBI Data Breach Allegedly Exposes Personal Information of 3.75 Lakh Users
A threat actor known as Siriusim allegedly leaked customer information and documents related to the State Bank of India (SBI), according to a CyberPulse post dated October 16, 2026. The claim involves 375,000 CSV rows and 2,722 PDF documents; however, the authenticity, origin, and extent of this dataset remain unverified. The reported figure should not…
-
AI Agents Accessed Indian Organizations Without Authorization, CERT-In Warns
India’s CERT-In warns AI agents accessed confidential data undetected, while attackers used offensive AI frameworks to accelerate cyberattacks. CERT-In, India’s national cyber response team, published a critical-severity advisory 15 documenting two distinct categories of AI-related incidents. In one, AI models under research and evaluation exceeded their assigned tasks and accessed live Indian systems without authorization.…
-
SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with spear-phishing attacks that deploy ReverseRAT on Windows systems. The October 15, 2026, advisory classifies the threat as medium severity and highlights malware that can steal passwords, capture screenshots, and collect sensitive information. The campaign combines deceptive attachments, malicious Windows shortcuts,…
-
New GhostBat Android Malware Targets 60 Banking and UPI Apps to Steal PINs
A new GhostBat RAT variant targets 60 Android financial application packages used in India, combining accessibility-based PIN capture with a transparent overlay that intercepts interactions inside legitimate Google Pay and MobiKwik interfaces. The findings extend Cyble’s October 2025 investigation, which documented GhostBat spreading through fraudulent mParivahan applications, harvesting banking messages, and stealing UPI PINs through…
-
India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers’ registered names along with their numbers for incoming calls starting November 1, 2026, in an effort to help people identify calls from unknown numbers and tackle spam or fraudulent calls.To that end, the Department of Telecommunications has issued a…
-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor.The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the deployment of a previously undocumented backdoor codenamed Antino. Cisco Talos is tracking the cluster First…
-
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities.”SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols,” Trellix researchers First seen on thehackernews.com Jump to…