Breaches and incidents
Operation Sindoor cyber wave (India): APT36 and SideCopy phishing plus 650+ hacktivist DDoS/defacement events
Seqrite Labs (published by Quick Heal) tracked spear-phishing from 17 Apr 2025 against government mail and defence (MoD, Army, Navy, DRDO) and counted 650+...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Seqrite Labs (published by Quick Heal) tracked spear-phishing from 17 Apr 2025 against government mail and defence (MoD, Army, Navy, DRDO) and counted 650+ confirmed DDoS/defacement events from 35+ hacktivist groups between 7 and 10 May 2025. Lures included “Final_List_of_OGWs.xlam”, “Preventive_Measures_Sindoor.ppam” and “Pahalgam_Incident_Timeline.pptx.lnk”; claimed hacktivist disruption of NIC and GSTN is unconfirmed.
- Technique: .ppam/.xlam/.lnk/.xlsb/.msi droppers, macros, LOLBins, UAC bypass; APT36 moving from Poseidon loaders to the Ares framework; spoofed domains such as nationaldefensecollege[.]com, zohidsindia[.]com, pahalgamattack[.]com, operationsindoor2025[.]in.
- Attacker: APT36 and SideCopy (Pakistan-linked) per Seqrite; hacktivists self-identified on Telegram (#OpIndia, #OperationSindoor).
- Response: Seqrite deployed 26 detection signatures; CERT-In issued baseline-measures advisories to MSMEs and industry on 10 May 2025 (CIAD-2025-0018, -0019) citing ransomware, DDoS, defacement and data breaches.