A series of data breaches affecting India’s national carrier have shone the spotlight on Chinese actors during an already intense geopolitical rivalry.
Even as massive data breach affecting Air India came to light last month, India’s national airline appears to have suffered a separate cyber assault that lasted for a period of at least two months and 26 days, recent revelations suggest.
The incident has been linked to a Chinese nation-state threat actor called APT41 according to chatter in cybersecurity circles.
While some believe that this may have been a supply chain attack targeting SITA (a multinational information technology company providing IT and telecommunication services to the air transport industry), the Swiss company denied these reports, suggesting that they are two different security incidents.
Also known by other monikers such as Winnti Umbrella, Axiom and Barium, APT41 is a prolific Chinese-speaking nation-state advanced persistent threat actor known for its campaigns centered around information theft and espionage against healthcare, high-tech, and telecommunications sectors to establish and maintain strategic access for stealing intellectual property and committing financially motivated cybercrimes.
How the new attack played out
It is believed an infected device inside Air India’s network (named “SITASERVER4”) communicated with a server hosting Cobalt Strike payloads dating all the way back to Dec. 11, 2020.
Following this initial compromise, attackers are said to have established their presence and obtained passwords in order to pivot to the broader network, with the goal of gathering information inside the local network.
No fewer than 20 devices were infected during the course of this movement. In all, the threat actors extracted 23.33 MB of data from five devices , with attackers taking 24 hours to spread Cobalt Strike beacons to other devices in the airline’s network. Concerningly, the initial entry point for the attack remains unknown as yet.
Double whammy after May incident
This particular incident comes after a May 21 incident, where Air India disclosed a data breach affecting 4.5 million of its customers over a period stretching nearly 10 years in the wake of a supply chain attack directed at its Passenger Service System (PSS) provider SITA.
The stolen information included passengers’ names, credit card details, date of birth, contact information, passport information, ticket information, Star Alliance and Air India frequent flyer data.
Other major carriers were also affected at the time, including Star Alliance members Singapore Airlines, New Zealand Air and Lufthansa.
The attacks highlight the rambunctious appetite of China-linked state and semi state actors to disrupt important commercial and national operations pertaining to governments around the world. This is the latest in a string of recent such activity, and should be a warning to government and related agencies everywhere to bolster device and network security to best-in-class standards.
