A Chinese state-backed hacking group has in recent weeks targeted the IT systems of Indian Covid vaccine makers Serum Institute of India and Bharat Biotech with the aim of stealing research data, according to cyber intelligence firm Cyfirma.
Chinese hacking group APT10, also known as Stone Panda, had identified gaps and vulnerabilities in the IT infrastructure and supply chain software of Bharat Biotech and the Serum Institute of India (SII), the world’s largest vaccine maker, states the report titled "Threat Landscape for Pharmaceutical Companies."
Goldman Sachs-backed Cyfirma, based in Singapore and Tokyo with large operations in Bengaluru, said the cyber attacks were aimed at stealing Covid vaccine research data, patient info, clinical trials data, supply chain and vaccine production information.
"The healthcare industry, and particularly, pharmaceutical companies, has been thrust directly under global spotlight. While the world stumbles in its search for recovery, cybercriminals lurking in the dark web have seized the global event to profit from the climate of fear and uncertainty," the report states.
India has shot ahead of China at the world centre stage in vaccine making and a desperate Beijing appears to be out to change this situation.
“The real motivation here is actually exfiltrating intellectual property and getting competitive advantage over Indian pharmaceutical companies,” said Cyfirma Chief Executive Kumar Ritesh told Reuters.
Ritesh, a former top cyber official with British foreign intelligence agency MI6, said APT10 was actively targeting SII, which is making the AstraZeneca vaccine for many countries and will soon start bulk-manufacturing Novavax shots.
“In the case of Serum Institute, they have found a number of their public servers running weak web servers, these are vulnerable web servers,” Ritesh said, referring to the hackers.
“They have spoken about weak web application, they are also talking about weak content-management system. It’s quite alarming.”
Cyfirma said in a statement it had informed CERT authorities and that they had acknowledged the threat.
The office of the director-general of the state-run Indian Computer Emergency Response Team (CERT) said the matter had been handed to its operations director, S.S. Sarma.
Sarma told Reuters CERT was a “legal agency and we can’t confirm this thing to media”.
Ritesh, whose firm follows the activities of some 750 cyber criminals and monitors nearly 2,000 hacking campaigns using a tool called DeCYFIR, said it was not yet clear what information APT10 may have accessed from the Indian companies.
According to the U.S. Department of Justice APT10 has been acting in association with the Chinese Ministry of State Security.
The development comes at a time when a new study in the US has concluded that the huge power failure in Mumbai that took place in October last year disrupting normal life in India’s commercial capital was caused by Chinese state-sponsored hackers who planted malware in the power control systems.
According to a report in the New York Times, the study shows that as the military face-off continued in Ladakh, Chinese malware was flowing into the control systems that manage electric supply across India, along with a high-voltage transmission substation and a coal-fired power plant.
The flow of malware was pieced together by Recorded Future, a US company that studies the use of the internet by state actors.
The massive power failure in Mumbai had brought local trains to halt and the stock markets had to be shut while hospitals were forced to switch to emergency generators to keep ventilators running amid the surge in coronavirus.
