Assessment of Reported Malware Infection at Nuclear Facility
Summary: NPCIL confirmed on October 30, 2019 a malware infection at the Kudankulam Nuclear Power Plant in Tamil Nadu, on a computer NPCIL said was on the administrative network isolated from the critical internal network, after CERT-In alerted officials on September 4. Dragos identified five samples functioning as payloads or droppers for the DTrack remote access tool, containing hard-coded private IP addresses and credentials specific to the facility, with no ICS-specific components and no indication of compromise to control or OT networks.
Why it matters: The malware carried a 'KKNPP' username and facility-specific credentials and private IP addresses, meaning the adversary built this for that plant rather than spraying it broadly. The outcome rested on segmentation: the same intrusion that reached an administrative network would have looked very different had that boundary not held.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026