{ "id": "ab494344-945e-4b01-ae05-31d7c9db6a9f", "created_at": "2026-04-06T00:06:18.580279Z", "updated_at": "2026-04-10T03:38:20.037759Z", "deleted_at": null, "sha1_hash": "fabc927379acda7f8a659d35bb337ed6be797401", "title": "Confirmed: North Korean malware found on Indian nuclear plant's network", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1000891, "plain_text": "Confirmed: North Korean malware found on Indian nuclear\r\nplant's network\r\nBy Written by Catalin Cimpanu, ContributorContributor Oct. 30, 2019 at 5:06 a.m. PT\r\nArchived: 2026-04-05 14:01:45 UTC\r\nImage via indiawaterportal.org\r\nThe network of one of India's nuclear power plants was infected with malware created by North Korea's state-sponsored hackers, the Nuclear Power Corporation of India Ltd (NPCIL) confirmed today.\r\nNews that the Kudankulam Nuclear Power Plant (KNPP) might have been infected with a dangerous strain of\r\nmalware first surfaced on Twitter on Monday.\r\nPukhraj Singh, a former security analyst for India's National Technical Research Organization (NTRO), pointed\r\nout that a recent VirusTotal upload was actually linked to a malware infection at the KNPP.\r\nThe particular malware sample included hardcoded credentials for KNPP's internal network, suggesting the\r\nmalware was specifically compiled to spread and operate inside the power plant's IT network.\r\nMalware linked to North Korea's Lazarus Group\r\nSeveral security researchers identified the malware as a version of Dtrack, a backdoor trojan developed by the\r\nLazarus Group, North Korea's elite hacking unit.\r\nSingh's tweet and revelation immediately went viral because just days before, the same power plant had an\r\nunexpected shutdown of one of its reactors -- with many users conflating the two unrelated incidents as one.\r\nInitially, KNPP officials denied that they've suffered any malware infection, issuing a statement to describe the\r\ntweets as \"false information,\" and that a cyber-attack on the power plant was \"not possible.\"\r\nhttps://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/\r\nPage 1 of 3\n\nknpp-statement-1.png\r\nImage: ZDNet\r\nBut today, NPCIL, the KNPP's parent company, admitted to the security breach in a separate statement.\r\n\"Identification of malware in NPCIL system is correct,\" the statement started.\r\nNPCIL said the malware only infected its administrative network, but did not reach its critical internal network,\r\nthe one used to control the power plant's nuclear reactors. NPCIL said the two networks were isolated.\r\nIn addition, NPCIL confirmed statements made by Singh on Twitter; that they received notification from CERT\r\nIndia back on September 4, when the malware was first spotted, and that they investigated the matter at the time\r\nof the report.\r\nNot actually a big deal\r\nAccording to an analysis of the Dtrack malware from Russian antivirus maker Kaspersky, this trojan includes\r\nfeatures for:\r\nkeylogging,\r\nretrieving browser history,\r\ngathering host IP addresses, information about available networks and active connections,\r\nlisting all running processes,\r\nlisting all files on all available disk volumes.\r\nAs evident from its features, Dtrack is usually used for reconnaissance purposes and as a dropper for other\r\nmalware payloads.\r\nPrevious Dtrack samples have been usually spotted in politically-motivated cyber-espionage operations, and in\r\nattacks on banks -- with a custom version of Dtrack, named AMTDtrack also being discovered last month.\r\nHistorically, the Lazarus Group or any other North Korean hacker group, have rarely gone after targets in the\r\nenergy and industrial sector. When they did, they went after proprietary intellectual property, rather than sabotage.\r\nMost of North Korea's offensive hacking efforts have been focused on attaining insight into diplomatic relations,\r\ntracking former North Korean citizens who fled the country, or hacking banks and cryptocurrency exchanges to\r\ngather funds for the Pyongyang regime to raise funds for its weapons and missile programs.\r\nThe KNPP incident looks more like an accidental infection, rather than a well-planned operation. This specifically\r\nseems to be the case, since Kaspersky reported last month that the Lazarus Group had been spotted spreading\r\nDtrack and AMDtrack versions across India, targeting its financial sector.\r\nArticle updated shortly after publication to include link to McAfee research on previous North Korean campaigns\r\ntargeting the energy and industrial sector.\r\nNorth Korea's history of bold cyber attacks\r\nhttps://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/\r\nPage 2 of 3\n\nSecurity\r\nSource: https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/\r\nhttps://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/\r\nPage 3 of 3", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA", "MITRE" ], "references": [ "https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/" ], "report_names": [ "confirmed-north-korean-malware-found-on-indian-nuclear-plants-network" ], "threat_actors": [ { "id": "34eea331-d052-4096-ae03-a22f1d090bd4", "created_at": "2025-08-07T02:03:25.073494Z", "updated_at": "2026-04-10T02:00:03.709243Z", "deleted_at": null, "main_name": "NICKEL ACADEMY", "aliases": [ "ATK3 ", "Black Artemis ", "COVELLITE ", "CTG-2460 ", "Citrine Sleet ", "Diamond Sleet ", "Guardians of Peace", "HIDDEN COBRA ", "High Anonymous", "Labyrinth Chollima ", "Lazarus Group ", "NNPT Group", "New Romanic Cyber Army Team", "Temp.Hermit ", "UNC577 ", "Who Am I?", "Whois Team", "ZINC " ], "source_name": "Secureworks:NICKEL ACADEMY", "tools": [ "Destover", "KorHigh", "Volgmer" ], "source_id": "Secureworks", "reports": null }, { "id": "732597b1-40a8-474c-88cc-eb8a421c29f1", "created_at": "2025-08-07T02:03:25.087732Z", "updated_at": "2026-04-10T02:00:03.776007Z", "deleted_at": null, "main_name": "NICKEL GLADSTONE", "aliases": [ "APT38 ", "ATK 117 ", "Alluring Pisces ", "Black Alicanto ", "Bluenoroff ", "CTG-6459 ", "Citrine Sleet ", "HIDDEN COBRA ", "Lazarus Group", "Sapphire Sleet ", "Selective Pisces ", "Stardust Chollima ", "T-APT-15 ", "TA444 ", "TAG-71 " ], "source_name": "Secureworks:NICKEL GLADSTONE", "tools": [ "AlphaNC", "Bankshot", "CCGC_Proxy", "Ratankba", "RustBucket", "SUGARLOADER", "SwiftLoader", "Wcry" ], "source_id": "Secureworks", "reports": null }, { "id": "a2b92056-9378-4749-926b-7e10c4500dac", "created_at": "2023-01-06T13:46:38.430595Z", "updated_at": "2026-04-10T02:00:02.971571Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Operation DarkSeoul", "Bureau 121", "Group 77", "APT38", "NICKEL GLADSTONE", "G0082", "COPERNICIUM", "Moonstone Sleet", "Operation GhostSecret", "APT 38", "Appleworm", "Unit 121", "ATK3", "G0032", "ATK117", "NewRomanic Cyber Army Team", "Nickel Academy", "Sapphire Sleet", "Lazarus group", "Hastati Group", "Subgroup: Bluenoroff", "Operation Troy", "Black Artemis", "Dark Seoul", "Andariel", "Labyrinth Chollima", "Operation AppleJeus", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Hidden Cobra", "Bluenoroff", "Stardust Chollima", "Whois Hacking Team", "Diamond Sleet", "TA404", "BeagleBoyz", "APT-C-26" ], "source_name": "MISPGALAXY:Lazarus Group", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "32a223a8-3c79-4146-87c5-8557d38662ae", "created_at": "2022-10-25T15:50:23.703698Z", "updated_at": "2026-04-10T02:00:05.261989Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "Lazarus Group", "Labyrinth Chollima", "HIDDEN COBRA", "Guardians of Peace", "NICKEL ACADEMY", "Diamond Sleet" ], "source_name": "MITRE:Lazarus Group", "tools": [ "RawDisk", "Proxysvc", "BADCALL", "FALLCHILL", "WannaCry", "MagicRAT", "HOPLIGHT", "TYPEFRAME", "Dtrack", "HotCroissant", "HARDRAIN", "Dacls", "KEYMARBLE", "TAINTEDSCRIBE", "AuditCred", "netsh", "ECCENTRICBANDWAGON", "AppleJeus", "BLINDINGCAN", "ThreatNeedle", "Volgmer", "Cryptoistic", "RATANKBA", "Bankshot" ], "source_id": "MITRE", "reports": null }, { "id": "f32df445-9fb4-4234-99e0-3561f6498e4e", "created_at": "2022-10-25T16:07:23.756373Z", "updated_at": "2026-04-10T02:00:04.739611Z", "deleted_at": null, "main_name": "Lazarus Group", "aliases": [ "APT-C-26", "ATK 3", "Appleworm", "Citrine Sleet", "DEV-0139", "Diamond Sleet", "G0032", "Gleaming Pisces", "Gods Apostles", "Gods Disciples", "Group 77", "Guardians of Peace", "Hastati Group", "Hidden Cobra", "ITG03", "Jade Sleet", "Labyrinth Chollima", "Lazarus Group", "NewRomanic Cyber Army Team", "Operation 99", "Operation AppleJeus", "Operation AppleJeus sequel", "Operation Blockbuster: Breach of Sony Pictures Entertainment", "Operation CryptoCore", "Operation Dream Job", "Operation Dream Magic", "Operation Flame", "Operation GhostSecret", "Operation In(ter)caption", "Operation LolZarus", "Operation Marstech Mayhem", "Operation No Pineapple!", "Operation North Star", "Operation Phantom Circuit", "Operation Sharpshooter", "Operation SyncHole", "Operation Ten Days of Rain / DarkSeoul", "Operation Troy", "SectorA01", "Slow Pisces", "TA404", "TraderTraitor", "UNC2970", "UNC4034", "UNC4736", "UNC4899", "UNC577", "Whois Hacking Team" ], "source_name": "ETDA:Lazarus Group", "tools": [ "3CX Backdoor", "3Rat Client", "3proxy", "AIRDRY", "ARTFULPIE", "ATMDtrack", "AlphaNC", "Alreay", "Andaratm", "AngryRebel", "AppleJeus", "Aryan", "AuditCred", "BADCALL", "BISTROMATH", "BLINDINGCAN", "BTC Changer", "BUFFETLINE", "BanSwift", "Bankshot", "Bitrep", "Bitsran", "BlindToad", "Bookcode", "BootWreck", "BottomLoader", "Brambul", "BravoNC", "Breut", "COLDCAT", "COPPERHEDGE", "CROWDEDFLOUNDER", "Castov", "CheeseTray", "CleanToad", "ClientTraficForwarder", "CollectionRAT", "Concealment Troy", "Contopee", "CookieTime", "Cyruslish", "DAVESHELL", "DBLL Dropper", "DLRAT", "DRATzarus", "DRATzarus RAT", "Dacls", "Dacls RAT", "DarkComet", "DarkKomet", "DeltaCharlie", "DeltaNC", "Dembr", "Destover", "DoublePulsar", "Dozer", "Dtrack", "Duuzer", "DyePack", "ECCENTRICBANDWAGON", "ELECTRICFISH", "Escad", "EternalBlue", "FALLCHILL", "FYNLOS", "FallChill RAT", "Farfli", "Fimlis", "FoggyBrass", "FudModule", "Fynloski", "Gh0st RAT", "Ghost RAT", "Gopuram", "HARDRAIN", "HIDDEN COBRA RAT/Worm", "HLOADER", "HOOKSHOT", "HOPLIGHT", "HOTCROISSANT", "HOTWAX", "HTTP Troy", "Hawup", "Hawup RAT", "Hermes", "HotCroissant", "HotelAlfa", "Hotwax", "HtDnDownLoader", "Http Dr0pper", "ICONICSTEALER", "Joanap", "Jokra", "KANDYKORN", "KEYMARBLE", "Kaos", "KillDisk", "KillMBR", "Koredos", "Krademok", "LIGHTSHIFT", "LIGHTSHOW", "LOLBAS", "LOLBins", "Lazarus", "LightlessCan", "Living off the Land", "MATA", "MBRkiller", "MagicRAT", "Manuscrypt", "Mimail", "Mimikatz", "Moudour", "Mydoom", "Mydoor", "Mytob", "NACHOCHEESE", "NachoCheese", "NestEgg", "NickelLoader", "NineRAT", "Novarg", "NukeSped", "OpBlockBuster", "PCRat", "PEBBLEDASH", "PLANKWALK", "POOLRAT", "PSLogger", "PhanDoor", "Plink", "PondRAT", "PowerBrace", "PowerRatankba", "PowerShell RAT", "PowerSpritz", "PowerTask", "Preft", "ProcDump", "Proxysvc", "PuTTY Link", "QUICKRIDE", "QUICKRIDE.POWER", "Quickcafe", "QuiteRAT", "R-C1", "ROptimizer", "Ratabanka", "RatabankaPOS", "Ratankba", "RatankbaPOS", "RawDisk", "RedShawl", "Rifdoor", "Rising Sun", "Romeo-CoreOne", "RomeoAlfa", "RomeoBravo", "RomeoCharlie", "RomeoCore", "RomeoDelta", "RomeoEcho", "RomeoFoxtrot", "RomeoGolf", "RomeoHotel", "RomeoMike", "RomeoNovember", "RomeoWhiskey", "Romeos", "RustBucket", "SHADYCAT", "SHARPKNOT", "SIGFLIP", "SIMPLESEA", "SLICKSHOES", "SORRYBRUTE", "SUDDENICON", "SUGARLOADER", "SheepRAT", "SierraAlfa", "SierraBravo", "SierraCharlie", "SierraJuliett-MikeOne", "SierraJuliett-MikeTwo", "SimpleTea", "SimplexTea", "SmallTiger", "Stunnel", "TAINTEDSCRIBE", "TAXHAUL", "TFlower", "TOUCHKEY", "TOUCHMOVE", "TOUCHSHIFT", "TOUCHSHOT", "TWOPENCE", "TYPEFRAME", "Tdrop", "Tdrop2", "ThreatNeedle", "Tiger RAT", "TigerRAT", "Trojan Manuscript", "Troy", "TroyRAT", "VEILEDSIGNAL", "VHD", "VHD Ransomware", "VIVACIOUSGIFT", "VSingle", "ValeforBeta", "Volgmer", "Vyveva", "W1_RAT", "Wana Decrypt0r", "WanaCry", "WanaCrypt", "WanaCrypt0r", "WannaCry", "WannaCrypt", "WannaCryptor", "WbBot", "Wcry", "Win32/KillDisk.NBB", "Win32/KillDisk.NBC", "Win32/KillDisk.NBD", "Win32/KillDisk.NBH", "Win32/KillDisk.NBI", "WinorDLL64", "Winsec", "WolfRAT", "Wormhole", "YamaBot", "Yort", "ZetaNile", "concealment_troy", "http_troy", "httpdr0pper", "httpdropper", "klovbot", "sRDI" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775433978, "ts_updated_at": 1775792300, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/fabc927379acda7f8a659d35bb337ed6be797401.pdf", "text": "https://archive.orkl.eu/fabc927379acda7f8a659d35bb337ed6be797401.txt", "img": "https://archive.orkl.eu/fabc927379acda7f8a659d35bb337ed6be797401.jpg" } }