Kudankulam Nuclear Power Plant: Its internal network is compromised by a malware that almost takes control of the installation

Finally, the internal network of the Kudankulam nuclear power plant, located in India, has been infected by a malware known as Dtrack.

Absolute computer security does not exist, even if hundreds of millions are invested in trying to achieve it. There is only one way that our system is not violated by an external attacker: that it is not connected to the internet. A few days ago, a rumor began to spread on Twitter of a possible malware infection at the Kudankulam nuclear power plant in India. The parent company managing the plant has confirmed this fact.

It is unknown at this time if the data on the KKNPP network has been compromised. In addition, Singh, a former analyst at India's National Technical Research Organization (NTRO), has said that it is not the only plant that would have been exposed. This incident would have been classified as an act of war. When asked about the claim, Singh says he can't elaborate for now.

Kudankulam Nuclear Power Plant Malware Infection Confirmed

The malware used is Dtrack, as it is called by Karspersky, it would have already been used to attack financial and research centers. Dtrack would share some elements with the source code of a malware attributed to the Lazarus group. The United States Department of Justice says that behind Lazarus would be the Government of North Korea.

Dtrack would be a tool used for spying and reconnaissance. It allows to record all the keystrokes, the scanning of all the networks and the monitoring of active processes in the infected systems.

The version of this malware used for the nuclear power plant indicates that it would have encrypted credentials for KKNPP's internal network. This suggests that the malware was adapted for its propagation and operation within this network.

According to Nuclear Power Corporation of India Limited, the malware only reached the administrative network. It would not have been able to cross into the internal network, which has the capacity to control nuclear reactors. Fortunately, the attack was unable to access the power control network. This attack would have been used to try to establish a persistent presence on this network.

Source: AT