Hacktivists Launch Coordinated Attacks on India’s Infrastructure

India’s digital infrastructure has become a high-value battleground for hacktivists. A new analysis from CYFIRMA highlights how July–August 2025 witnessed an unprecedented surge of cross-border cyber operations combining breaches, disruptions, phishing, and advanced malware against Indian institutions.

According to the report, “coordinated cross-border campaigns from Pakistan, Bangladesh, Russia, Indonesia, and likely China targeted Indian judicial, defense, and transport systems.” These campaigns mark a shift from isolated attacks to “coordinated, multi-nation campaigns against India’s digital infrastructure.”

Among the most damaging incidents was the breach of High Court servers in Punjab & Haryana and Andhra Pradesh. CYFIRMA notes that Pakistani group Team Insane Pakistan allegedly compromised millions of case records, FIRs, login credentials, and judicial officer databases, mocking the judiciary by labeling it the “uneducated judges whole database.”

The disruption extended beyond data theft. On India’s Independence Day, Sylhet Gang-SG launched a DDoS attack on the Ministry of Defense website, showcasing the fragility of critical government portals. At the same time, Russian-aligned collective RuskiNet pre-signaled its “Operation Trinetara”—a cyber retaliation campaign tied to the Palestine conflict, amplifying psychological pressure.

India did not remain passive. Hacktivist groups under Operation Vasudev Strike—including Shadow Phantom, Team Red Eagle, and Shadow Protocol—hacked into Pakistan’s Ibn-e-Sina University and publicly exposed administrative credentials. CYFIRMA highlights this as a demonstration of India’s growing offensive posture in the cyber domain.

The attacks were not limited to state infrastructure. The Indonesian group Raizo defaced an Indian transport website with political slogans, while attackers cloned the eChallan portal to harvest citizens’ personal data such as PAN numbers and dates of birth.

Perhaps the most sophisticated operation came in the form of phishing campaigns masquerading as Income Tax penalty notices. Victims were lured into downloading a 43 MB malware installer named 103.97.128.77#ClientSetup.exe. As CYFIRMA’s analysis states, “metadata with Simplified Chinese resources indicated likely Chinese actor involvement, blending spear-phishing with advanced malware tactics”.

The malware demonstrated persistence through process injection, concealed its operations with configuration files like YTSysConfig.ini, and established command-and-control connections to a suspicious IP address. The campaign highlights how hacktivists are increasingly adopting advanced tradecraft typically associated with state-sponsored cybercrime.

CYFIRMA concludes that “the events of July–August 2025 highlight a significant escalation in hacktivist-driven cyber operations against India.”

With India’s retaliatory campaigns gaining momentum, the region faces a growing cycle of offensive and defensive cyber activity. As the report warns, these developments emphasize the “urgent need for stronger threat intelligence, proactive defense measures, and cross-agency coordination to protect national security and public trust in digital infrastructure.”

Related Posts:

• Pakistan bans financial institutions from participating in cryptocurrency transactions
• Pakistan Under Cyberattack: Unmasking the Blue Locker Ransomware Campaign
• Microsoft Shuts Down Pakistan Office After 25 Years, Citing Global Restructuring
• Smishing Triad Targets Pakistan with Large-Scale Banking Scam
• Bitter APT Targets Pakistan Telecom Amidst Border Tensions with New Cyberattack!