---
title: "Pak group targets Indian critical infra, cyber security firm warns of phishing attack"
id: 295slug: "pak-group-targets-indian-critical-infra-cyber-security-firm"
category: "News"
description: "A suspected Pakistani group has started modern phishing attacks on India’s sensitive infrastructure such as power, telecom, and Finance, according to a leading cybersecurity firm."
canonical_url: "https://infosaurs.com/news/pak-group-targets-indian-critical-infra-cyber-security-firm/295"
date_published: "2021-07-11T00:00:00+00:00"
last_modified: "2021-07-11T00:00:00+00:00"
entity_type: "Person"
publisher: "INFOSAURS Media AG"
format: "markdown"
---

# Pak group targets Indian critical infra, cyber security firm warns of phishing attack
**Registry Identifier:** Record #000295  
**Archival Track:** Verified Biographical Dossier  
**Canonical Record:** [View Live Web Page](https://infosaurs.com/news/pak-group-targets-indian-critical-infra-cyber-security-firm/295)  
**Last Verified:** July 11, 2021
> A suspected Pakistani group has started modern phishing attacks on India’s sensitive infrastructure such as power, telecom, and Finance, according to a leading cybersecurity firm.
---

A suspected **Pakistani group** has started modern phishing attacks on India’s sensitive infrastructure such as power, telecom, and Finance, according to a leading cybersecurity firm.

**Pentapostagma **reported that a cybersecurity consultant of **Quick Heal Technologies** said that a suspected Pakistani group has started a wave of sophisticated phishing attacks targeting India’s crucial infrastructure such as power and telecom.

As per the security consultant, the final intrusion chain begins with a spear-phishing email – an email that is designed to get the user to install a virus, trojan or other **malware**.

Often, the emails pretend to be from government agencies and also come attached with a fake document – such as an IT return and urges the user to download and open it, reported **Pentapostagma**.

“The email content attempts to lure the user into extracting the attached zip archive. Upon extraction, the user would see a document file which is in fact an extension spoofed LNK file which is usually seen a shortcuts”, the company said.

“The user opens the document, the LNK payloads gets launched and initiates the malicious activities in the background. To ensure the user is not suspicious, a decoy document is presented to him/her.”, it said. LNK is a widely deployed Windows link format that is typically used as a shortcut to launch programs or executables.

“Once the LNK file is launched, it downloads the HTA payload from a compromised domain and executes it via mshta.exe. This HTA file is responsible for showing the decoy document to the user . In addition , it drops an executable of LimShell on disc and executes it”.

The cybersecurity consultant found that the command and control servers were from Pakistan.

Further investigation revealed that the provider of the IP address is Pakistan Telecommunication Company Limited.

“This revelation further strengthens the claim that Opration Side copy which is operated by the Transparent Tribe group is originating in **Pakistan**. The report further revealed the list of targets that were identified through the analyzed C2s. These targets include Critical infrastructure PSUs from telecom, power and finance sectors”.**

Source: https://www.news18.com/news/india/pakistan-based-hackers-targeting-critical-infrastructure-psus-in-india-3943676.html**
---
*Archived by INFOSAURS Knowledge Registry. For data verifications or editorial amendments, query [INFOSAURS Desk](https://infosaurs.com).*