Chinese hacker attack Indian websites

Indian military research bodies and Tibetan activists have been targeted by hackers based in China, with a former graduate student at a Chinese university emerging as a key figure responsible for the cyber breach, according to a report by a computer security firm.
In its 24 page report, Tokyo-based Trend Micro said the hacking campaign, dubbed ‘Luckycat’ targeted Indian military research institutions, entities in Japanas well as the Tibetan community.



The campaign, active since around June 2011, has been linked to 90 attacks against targets in Japan and India as well as Tibetan activists. In all, the Luckycat campaign managed to compromise 233 computers in systematic attacks.
Victims of the attack also include Indian shipping companies, Japan’s aerospace, energy and engineering companies and at least 30 computer systems of Tibetan advocacy groups.

Trend Micro said each malware attack involves a unique campaign code that can be used to track which victims were compromised by which malware attack.

“This illustrates that the attackers are both very aggressive and continually target their intended victims. These are not smash-and-grab attacks but constitute a “campaign” comprising a series of ongoing attacks over time,’ it said in its report.
Trend Micro tracked elements of the cyber attack campaign to hackers based in China.

The Luckycat campaign attacked a diverse set of targets using a variety of malware, some of which have been linked to other cyber-espionage campaigns.
The attackers behind this campaign maintain a diverse set of command-and-control infrastructure and leverages anonymity tools to obfuscate their operations, the report said.
It cited the example of a hacking attack on India’s ballistic missile defence programme.

In this, a malicious document containing information on the programme was used to lure potential victims into opening it.

This document contained malicious code that exploited a vulnerability in computer software enabling the hackers to penetrate the compromised computer.