Cybersecurity Firm Says China May Have Been Responsible for the Mumbai Power Outage in October 2020

A new study has indicated that the power outage in Mumbai last year could be linked to the Indo-China border dispute that took shape in June 2020. 

The study cited by the New York Times goes on to say that the city’s power outage may have been due to a malware attack by China so as to warn India against pressing too hard on the border issue. The power failure in Mumbai last year was reportedly the worst in decades. 

Citizens witnessed the outage on October 12, 2020, beginning at around 10 AM and lasting for a few hours. Fortunately, the grid was restored and power was mostly back by noon. 

An initial investigation by the Maharashtra Cyber Cell revealed that the malware infusion was traced at the state load dispatch centre in Padgha, Thane. Initially, officials said that the cause of the power failure was tripping at this facility. 

The malware tracing was reportedly conducted by an American cybersecurity firm known as Recorded Future. The report went on to add that most of the malware wasn’t activated, indicating that only a small number of the malware caused the power outage in the city. 

However, the cybersecurity firm was unable to examine the code as it could not get inside India’s power systems. Taking this into account, the firm has said that they have sent these details to the Indian Computer Emergency Response Team (CERT-In) which is a branch within the Ministry of Electronics and Information Technology (MeitY).

Read - Major Power Outage In MMR Due To ‘Interruption In Supply’

Although the Indian Government has reportedly acknowledged the receipt of this information, officials are yet to confirm or deny if the infected code at the power grid has been traced back to the Chinese government. 

What’s more important from this new revelation is that it also reveals an organization that was responsible for the malware attack. The firm has said that RedEcho, a Chinese state-sponsored group, is “more than likely” to blame for the attack on the city’s grid. 

Also read - Foul Play Can't Be Ruled Out: Nitin Raut On Power Outage In MMR

A blog post by Recorded Future details the approach used by the attackers. “Since early 2020, Recorded Future's Insikt Group observed a large increase in suspected targeted intrusion activity against Indian organizations from Chinese state-sponsored groups,” the blog post said.

“From mid-2020 onwards, Recorded Future's midpoint collection revealed a steep rise in the use of infrastructure tracked as AXIOMATICASYMPTOTE, which encompasses ShadowPad command and control (C2) servers, to target a large swathe of India's power sector. 10 distinct Indian power sector organizations, including 4 of the 5 Regional Load Despatch Centres (RLDC) responsible for the operation of the power grid through balancing electricity supply and demand, have been identified as targets in a concerted campaign against India's critical infrastructure. Other targets identified included 2 Indian seaports,” the blog post added.   

Read - China Spies On Prominent Indian Citizens Including President, PM Modi