BlackCat ransomware gang targeted Indian weapons manufacturer, stole classified military secrets

Solar Industries Limited India, an Indian explosives and weapons manufacturer, suffered a significant ransomware attack that compromised vast amounts of sensitive and classified information.

Founded in 1993, Solar Industries India claims to be a globally-evolved and recognised industrial explosives manufacturer, catering to the needs of the Indian armed forces and foreign militaries.

Without sharing many details, an Indian government source told The Times of India that “the Nagpur-based company has been a target of ransomware attack. The government is investigating the extent of the data compromised and the source of the attack.”

On January 26, the notorious BlackCat or ALPHV ransomware gang listed Solar Industries as a victim on its data leak site. The group claimed to have accessed a whopping 2 terabytes of classified and sensitive data, including full descriptions of engineering specifications, weaponry audits, and drawn blueprints.

The gang has offered to sell classified information like drawings, engineering specifications, and audits of Pinaka rockets, Brahmos, Akash, several warheads, mines, bombs, and other sensitive defence products to the highest bidder on the dark web.

Furthermore, classified information like audit reports of many weapons including Rocket Pinaka MK-1, ADM-1, propellant Pinaka MK-II Enhanced, propellant Pinaka MK-2 Guided, details of warhead composition, technical power, company’s contract with the army and other customers, blueprints, and engineering details of many weapons, explosives, booster, propellant, and bombs were also stolen by the threat actors.

Some local media reports also suggest that security camera footage, office backups, audit reports of flaws and vulnerabilities, armament supply chains to various sources, and personally identifiable information of employees and customers were also compromised.

According to local media, company officials learned about the ransomware attack on January 21 and immediately alerted relevant authorities. A complaint has been registered at the city Cyber police station for invoking sections of extortion under the Indian Penal Code (IPC) and the Central Bureau of Investigation (CBI) is investigating the security incident.

The company is yet to provide an official statement and its website is still inaccessible with a “Site Under Maintenance” banner in place.

In November last year, the New Delhi-based All India Institute of Medical Sciences (AIIMS), one of India’s premier healthcare institutions, suffered a debilitating ransomware attack that crippled its daily operations.

The ransomware attack corrupted the healthcare organisation’s primary and first backup servers, crippled its internal IT network, and disrupted routine health services that the institution provides to thousands of patients every day. It also affected AIIMS’ e-hospital system including appointments and registration at outpatient departments (OPD), billing at inpatient departments (IPD), laboratory report generation, smart labs, and several other patient care services.

As per an incident report shared by the hospital’s medical director Dr M Srinivas to the central government’s Ministry of Health and Family Welfare, the hospital first identified the cyber attack when the emergency lab failed to access reports in the National Information Centre (NIC) laboratory system. Soon, similar reports started pouring in from other departments.