Sub Unit Alpha (-) (Rein)
Cmd., OP, Cyberwarfare Div.
FPO LT CA 900xx
From. CTCT, RLT-27
To. CMG, 1MarDiv, (-Rein)
Subj. Status, Cyberwarfare, India.Pakistan.
02 May 2025
Encl. (1) Submitted herewith, rf. 5750.7 Zulu.
CLASSIFIED
PART I. ORGANIZATIONAL DATA
A. India
1. India's Primary Cyber Defense Agencies
a. CERT-In
(1) Role: National nodal agency for cybersecurity incident response, issuing alerts, and coordinating best practices.
(2) Focus: Non-critical infrastructure protection, threat analysis, and collaboration with international agencies.
b. NCIIPC
(1) Role: Safeguards Critical Information Infrastructure (e.g., power grids, financial systems) under Section 70A of the IT Act.
(2) Focus: Prevents debilitating attacks on national security and economic stability.
c. Defence Cyber Agency (DCyA)
(1) Role: Military cyber operations, including offensive/defensive actions against state-sponsored threats (e.g., Pakistan, China).
(2) Structure: Tri-services unit under the Ministry of Defence, led by a two-star officer.
d. National Cyber Coordination Centre (NCCC)
(1) Role: Real-time cyber threat monitoring and strategic coordination across agencies.
2. Oversight & Policy
a. National Security Council Secretariat (NSCS):
(1) Provides strategic direction and coordinates cybersecurity policies across ministries.
b. Ministry of Home Affairs (MHA):
(1) Handles cybercrime and implements content restrictions.
c. Ministry of Electronics & IT (MeitY):
(1) Supports CERT-In and manages non-military cybersecurity frameworks.
B. Pakistan
1. Core Government Entities
a. PKCERT:
(1) The National Cyber Emergency Response Team handles threat detection, incident response, and policy development while collaborating with international CERTs.
b. NCCS:
(1) The National Centre for Cyber Security coordinates R&D labs across 11 universities, focusing on forensics, IoT security, and critical infrastructure protection.
2. Key Private-Sector Players
a. Secure Networks:
(1) Provides solutions like penetration testing, compliance audits, and network security for businesses and government bodies.
b. Apprise Cyber:
(1) Offers penetration testing, ISO 27001 implementation, and security training with 15+ years of expertise.
c. IdealSols:
(1) Delivers threat intelligence and vulnerability assessments through its Pakistan-based teams.
3. Collaborative Framework
a. Academia-Industry Links:
(1) NCCS labs (e.g., Air University’s forensics lab) partner with global research institutes and local firms like those listed on Clutch (e.g., Ebryx, Rewterz).
b. Capacity Building:
(1) PKCERT runs national cyber drills, awareness campaigns, and technical training programs.
(2) NCCS advances applied research in malware analysis and blockchain security.
4. This network combines policy enforcement (PKCERT), innovation (NCCS), and private-sector implementation (Secure Networks, Apprise Cyber) to address evolving threats.
PART II. NARRATIVE SUMMARY
Following the Pahalgam terrorist attack (22 April 2025), India has faced a coordinated cyber offensive linked to Pakistan-based groups, characterized by website defacements, phishing campaigns, and psychological warfare tactics:
1. Scale & Coordination:
a. Nearly 1 million cyberattacks were recorded within 8 days, involving collaboration between groups like Team Insane PK (Pakistan), Mysterious Team Bangladesh, and Moroccan Dragon.
2. Key Incidents
a. Rajasthan Education Department:
(1) Defaced by "Pakistan Cyber Force" with messages alleging the Pahalgam attack was an "inside job" and threatening "bytes over bullets."
b. Army College of Nursing:
(1) Hacked by Team Insane PK, displaying images of the Pahalgam attack and militant Burhan Wani.
c. Armed Forces Websites:
(1) Attempted breaches of Army Public Schools (Srinagar/Ranikhet), welfare portals, and Air Force databases.
3. Tactics & Tools:
a. Phishing:
(1) Malicious PDFs mimicking official reports on Pahalgam circulated to harvest data.
b. Malware:
(1) CrimsonRAT and MeshAgent deployed via targeted emails.
c. Psychological Messaging:
(1) Hackers emphasized religious divides ("Muslims vs. Hindus") and referenced past conflicts (e.g., Abhinandan Varthaman's capture).
PART III. SIGNIFICANT TECHNICAL ASPECTS
Cyber Defense Operations. India’s cyber restrictions against Pakistan are managed through a coordinated effort involving multiple agencies:
a. National Cybersecurity Architecture:
(1) National Critical Information Infrastructure Protection Centre (NCIIPC).
(2) Indian Computer Emergency Response Team (CERT-In), detected and neutralized cyberattacks on military-affiliated websites (Army Public Schools, AWHO, IAF Placement Portal) in real time.
(3) Military Cyber Units: Specialized teams under the Defence Cyber Agency isolated compromised sites, traced attacks to Pakistan-based hackers (e.g., “IOK Hacker”), and implemented restorative measures.
b. Content and Access Restrictions
(1) Ministry of Home Affairs (MHA): Recommended blocking Pakistani YouTube channels and websites disseminating anti-India content.
(2) Department of Telecommunications (DoT): Likely involved in enforcing IP address blocks and coordinating with ISPs to restrict access to Pakistani websites.
c. Intelligence Coordination
(1) Intelligence Bureau (IB) and Research & Analysis Wing (RAW): Provided assessments attributing cyberattacks to Pakistan-based actors.
PART IV. CIVIL AFFAIRS
The international press and social media reactions to cyber warfare and restrictions following the Pahalgam attack highlight escalating tensions and digital conflict:
1. Cyber Warfare
a. Scale of Attacks: Over 1 million cyberattacks targeted Indian systems post-attack, attributed to groups from Pakistan, the Middle East, Indonesia, and Morocco.
2. State-Linked Campaigns:
a. APT36 (Pakistan-linked) used phishing decoys themed on the attack to target Indian government/defense personnel via fake domains mimicking official entities like Jammu & Kashmir Police.
b. Pro-India hackers breached Pakistani government databases (e.g., AJK Supreme Court, Sindh Police), while Pakistani groups defaced Indian sites, including the Army College of Nursing.
3. Geopolitical Strategy:
a. Cybersecurity experts warned such attacks are now a "geopolitical tool," with phishing domains mimicking Indian government sites to spread malware.
4. International Press Coverage
a. Escalation Focus: Outlets like CNN and Al Jazeera emphasized the attack’s role in cratering India-Pakistan relations, with cyber conflict compounding traditional military tensions.
b. Human Impact: Graphic social media posts of victims circulated widely, amplifying global scrutiny of Kashmir’s security situation.
5. Social Media Dynamics
a. Disinformation Risks: Phishing PDFs and fake domains exploited public outrage, leveraging the attack’s emotive impact to infiltrate systems.
b. Hacktivist Messaging: Defaced websites included ideological statements (e.g., religious polarization), mirroring rhetoric from Pakistani military leadership.
PART V. SUPPORTING DOCUMENTS
Key sources detailing India-Pakistan cyberwarfare developments following the Pahalgam attack:
1. Firstpost Analysis
a. Reports Pakistan-based hackers defaced the Indian Army College of Nursing website on April 25 with inflammatory messages, part of Islamabad's "psychological warfare."
(1) Experts warn such attacks are now "extensions of geopolitical strategy" and likely to escalate.
2. India TV News
a. Documents cross-border cyber campaigns:
(1) Indian hacktivists targeted Pakistani government/private entities like AJK Supreme Court and Sindh Police.
(2) Pakistan-linked groups deployed phishing domains mimicking Indian government sites and distributed malicious PDFs.
3. Academic Context
a. JDSS Journal (Jan 2025) analyzes how cyber capabilities are now integrated into nuclearized rivalries, risking critical infrastructure disruption.
b. Sage Journal (April 2025) highlights cyberweapons' strategic role in modern conflicts like India-Pakistan tensions.
4. Government Responses
a. Indian officials claim to have thwarted state-backed Pakistani attacks targeting defense, government systems, and critical infrastructure since the attack.
5. International sources and social media.
6. Synthetic intelligence query: Perplexity AI
Image: https://openart.ai/community/Frd1FZvURq4kGXvRCvrr
Report prepared by. J-Charlie.Lima. (204xxxx-2533).tbranch. Ctct.
CLASSIFIED
End.of.Report.
