MalwarePublished 15 Sep 2025Updated 15 Oct 2025

Digital Frontlines: India Under Multi-Nation Hacktivist Attack

Source AlienVault OTX General

Description

In July-August 2025, India faced a surge of cross-border cyberattacks combining data breaches, DDoS, defacement, phishing, and malware. Pakistani, Bangladeshi, Russian, Indonesian, and likely Chinese actors targeted Indian judicial, defense, and transport systems. High-impact incidents included judicial server breaches, government website disruptions, retaliatory defacements, phishing schemes, and malware campaigns. Indian groups retaliated under 'Operation Vasudev Strike'. The attacks demonstrated the growing scale, sophistication, and multinational nature of hacktivist operations targeting India's digital infrastructure, blending hacktivism and cybercrime to challenge national security and public trust.

Impact

For European organizations, the direct impact of this threat is currently limited given the primary targeting of Indian government and critical infrastructure sectors. However, the multinational nature of the attack and the use of globally accessible malware and phishing infrastructure pose indirect risks. European entities with business ties, supply chain dependencies, or digital interconnections with Indian judicial, defense, or transport sectors could face spillover effects such as phishing campaigns or malware infections leveraging similar tactics. Additionally, the use of common malware techniques and infrastructure could be adapted or redirected against European targets in future campaigns. The reputational damage and erosion of trust in digital services due to such large-scale hacktivist operations also resonate globally, potentially influencing European public sector cybersecurity postures. Moreover, European organizations involved in geopolitical intelligence, cybersecurity defense, or diplomatic relations with the affected regions should be vigilant for related threat actor activity and information operations.

Defensive guidance

1. Implement advanced email security solutions with robust phishing detection and sandboxing capabilities to identify and block spear-phishing attempts similar to those used in this campaign. 2. Employ endpoint detection and response (EDR) tools capable of detecting suspicious process masquerading (e.g., smss.exe, svchost.exe variants) and anomalous persistence mechanisms (T1547). 3. Conduct regular threat hunting exercises focusing on the identified malware hashes and network indicators such as suspicious domains and IP addresses linked to the campaign. 4. Harden public-facing applications and services against exploitation (T1190) through timely patching, web application firewalls, and vulnerability scanning. 5. Enforce strict network segmentation and least privilege access controls to limit lateral movement and reduce the impact of potential breaches. 6. Maintain up-to-date threat intelligence feeds to monitor evolving hacktivist tactics and infrastructure, enabling proactive defense. 7. Conduct user awareness training emphasizing recognition of phishing and social engineering tactics employed by hacktivists. 8. Collaborate with national and international cybersecurity agencies to share intelligence and coordinate responses to multinational hacktivist threats.

Indicators of compromise

Domains 6

enzedi.com
fhauifhyileydhfl.com
yunvxi.com
rsa.morth.gov.in
rto.dc7.live
wtqz3bn75j7ha49f82k.dewakartu.top

URLs 5

https://enzedi.com/
https://fhauifhyileydhfl.com/
https://rto.dc7.live
https://wtqz3bn75j7ha49f82k.dewakartu.top/
https://yunvxi.com/

IP addresses 1

202.189.10.112

Hashes 6

099a4c52210bfa8a5ba3d793f453b5d5
0a173143714e74d73d4c640b74f7c180
0d6e973a60a3a25e288d752b83e3228e11268b77
9f694cf1a87cc5c84fed5e0e45c13e794e92204f
54660fd2ff160f70a3ae5d8e54fca990562e4bfee1f8fdc882261e35420d209b
b75dec6f19a3dec025862a0d6e7dd565ad49c327cd85c21d5135ccffef60e68f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 15 Sep 2025, 19:21 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details