Amid G20 Summit, Indonesian Hacker Groups Target Indian Organisations And Digital Infrastructure

As India gears up to host the two-day G20 Summit beginning Saturday, online hacker groups have announced cyber-attacks against India’s digital infrastructure. Multiple cyber threat actors based out of Indonesia have claimed that Indian websites will be under attack from September 9, the first day of the G20 summit.  

Claims around possible cyber attacks were first reported by cyber intelligence platform Falcon Feeds. It has identified a large network of hacker groups, including outfits called Jambi Cyber Team and Ganosec Team, that has announced cyber attacks on Indian organisations.  

Nandakishore Harikumar, CEO of cyber security firm Technisanct that operates Falcon Feeds, told Outlook Business that law enforcement authorities have already been alerted about the threat. “The agencies are aware, and we have also been tracking these activities. The moment we come across anything concerning, we have been updating the appropriate authorities,” he said. 

In addition to the above-mentioned groups, there is a wider network of smaller affiliate groups that are joining in on the cyber threat operation planned against India. The operation is named #OPINDIA. These groups are actively coordinating over cloud-based messaging platform Telegram.    

Based on messages shared on the telegram channels associated with the threat actors, the motive behind the attack seems to be political and religious in nature. It was earlier reported that Indian authorities concerned with cyber security are already looking into possible cyber attacks against G20 Summit, originating from groups backed by Pakistan and Khalistan outfits. 

According to a Hindustan Times report, teams within agencies like Computer Emergency Response Team (CERT-In), National Critical Information Infrastructure Protection Centre (NCIIPC), I4C (Indian Cybercrime Coordination Centre), Delhi Police, Intelligence Bureau (IB), Research and Analysis Wing (R&AW), National Investigation Agency (NIA) and Central Bureau of Investigation (CBI) are coordinating among each other to iron out cyber vulnerabilities ahead of the G20 Summit. 

Websites Under Attack 

So far, a combination of Indian government organisations and private businesses have come under attack as part of the threat operation. The website of the state governor of Bihar has also seen recent cyber attacks but it’s not clear whether that is related to threat posed by Indonesian hacker groups. 

Other private websites facing threat from these groups include those of Indian businesses in sectors like logistics, pharma, banking and media. “There are limitations on law enforcement agencies when it comes to private websites but with government websites, they can respond very quickly,” said Harikumar. So far, the attacks have involved distributed denial-of-service (DDoS) activities and website defacement. 

This is not the first time that G20 Summits have faced the threat of cyber attacks. In 2011, when Paris was hosting the multilateral summit, hackers gained access to the G20 virtual system via coordinated phishing attacks. 

“These attacks are largely political in nature. Since G20 is a gathering of several world leaders, threat actors target such events for visibility,” added Harikumar.  

The two-day G20 Summit taking place in the Bharat Mandapam Convention Centre at Pragati Maidan, New Delhi will witness participation of leaders from 40 nations including the 20 member states. This is the first time that India is hosting the G20 Summit.