Glossary term
MITRE ATT&CK
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
Read more
Significant cyber incident
Kudankulam nuclear plant malware, 2019
In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware.
In short
In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware. The plant first called the claim baseless. On 30 October 2019 its operator, NPCIL, confirmed that malware had been identified, flagged by CERT-In on 4 September 2019. In November 2019 a minister told the Lok Sabha that the infection was limited to the administrative network.
What happened
On Monday 28 October 2019 cyber security researchers took to Twitter after a data dump. The News Minute reported that the data contained evidence of the malware Dtrack infecting a computer or computers at the Kudankulam Nuclear Power Project. Dtrack is spyware, which the same report said was reportedly developed by the North Korea-based group Lazarus.
The plant first rejected the claim. A KKNPP official called the tweets and allegations baseless. The plant’s information officer said the control systems were standalone and not connected to any outside cyber network or the internet, as reported by PTI. A day later, on 30 October 2019, NPCIL said the identification of malware in its system was correct. Its press release said CERT-In had conveyed the matter when it noticed it on 4 September 2019, that Department of Atomic Energy specialists investigated immediately, and that the infected PC belonged to a user on the internet-connected administrative network.
NPCIL said that network is isolated from the critical internal network and is continuously monitored. It also said the plant systems were not affected. The News Minute noted that NPCIL did not say which malware was found or whether it was on a system maintained by KKNPP.
On 20 November 2019 Minister of State Jitendra Singh answered a written question in the Lok Sabha. The reply said a malware infection was identified in the Kudankulam internet-connected system, that the affected system contains data related to administrative function, and that investigations by the Department of Atomic Energy and CERT-In concluded the infection was limited to the administrative network. The Quint noted that the minister made no mention of the source of the attack.
Timeline
-
3 September 2019
The Quint, citing The Indian Express, reports that the National Cyber Coordination Centre received intelligence inputs on this day. ISRO had not confirmed.
-
4 September 2019
CERT-In flags the malware to NPCIL, according to the NPCIL press release. The News Minute reports that a Twitter user also notified the National Cyber Security Coordinator on this day.
-
28 October 2019
Researchers say on Twitter that Dtrack was found on computers at the Kudankulam plant, after a data dump.
-
29 October 2019
Plant officials call the allegations baseless and say the control systems are standalone and not connected to the internet.
-
30 October 2019
NPCIL says the identification of malware in its system is correct and that the infected PC was on an internet-connected administrative network.
-
30 October 2019
NPCIL says plant systems were not affected. It does not name the malware, according to The News Minute.
-
2 November 2019
The NPCIL chairman says the reactors are safe and being monitored by experts, according to Onmanorama.
-
6 November 2019
The Quint reports, citing The Indian Express, that NPCIL and ISRO were alerted on 4 September after intelligence inputs on 3 September.
-
20 November 2019
Minister of State Jitendra Singh tells the Lok Sabha in a written reply that a malware infection was identified in the internet-connected system.
-
22 November 2019
World Nuclear News reports that DAE and CERT-In investigations concluded the infection was limited to the administrative network.
How the attack worked
Official sources give few technical details. The points below are what NPCIL, the minister and the reports state.
The infection
NPCIL said an infected PC belonged to a user on the internet-connected administrative network. The minister’s reply said the system manages day-to-day administrative activities and contains data related to administrative function. The way the malware got onto the PC is not stated in the sources opened.
The malware
The News Minute said researchers named Dtrack, a spyware. NPCIL did not name the malware in its release. MITRE ATT&CK lists Dtrack as spyware discovered in 2019 and used against Indian financial institutions, research facilities and the Kudankulam plant. MITRE describes the tool as able to collect information from victim machines, to download and upload files, to log keystrokes through a dropper component and to pack collected data in a password protected archive. These are MITRE’s descriptions of Dtrack in general. The sources opened do not say which of these functions ran on the Kudankulam PC.
The separation claim
NPCIL and the minister said the administrative network is isolated from the critical internal network. World Nuclear News said the plant’s control and instrumentation system is not connected to any external network, including the internet, intranet and the administrative system. The Quint quoted the minister as saying the fault happened only in the internet circuit of the administrative block. No independent check of these statements is available in the sources opened.
- InfectionMalware identified on a PC on the internet-connected administrative network
- DetectionCERT-In flagged it to NPCIL on 4 September 2019
- ReviewDAE specialists and CERT-In investigated the system
- FindingInfection limited to the administrative network, isolated from the critical network
Who says who was behind it
No public attribution by the Indian government. The minister made no mention of the source of the attack (The Quint, 20 November 2019).
Reported by The News Minute, 30 October 2019: Dtrack is reportedly developed by the North Korea-based group Lazarus.
Stated by MITRE ATT&CK: Dtrack shares similarities with the DarkSeoul campaign, which was attributed to Lazarus Group. MITRE does not say that Lazarus ran the Kudankulam infection.
The sources opened do not name the operator of the Kudankulam infection.
Malware and vulnerabilities used
Impact
Systems: the infection was on the internet-connected administrative network. DAE and CERT-In concluded it was limited to that network (World Nuclear News, 22 November 2019).
Plant operation: NPCIL said plant systems were not affected. The minister said the fault was only in the internet circuit of the administrative block.
Data: the minister said the affected system contains data related to administrative function. The sources opened do not say what was taken.
Trust: the plant first called the claim baseless, and NPCIL confirmed the malware the next day. The News Minute noted NPCIL did not say which malware was found.
Government and regulator response
- 4 September 2019: CERT-In conveyed the matter to NPCIL, according to the NPCIL press release.
- Immediately after: Department of Atomic Energy specialists investigated, per the release, and found the infected PC belonged to a user on the administrative network.
- 30 October 2019: NPCIL confirmed the malware identification and said the administrative network is isolated from the critical internal network and continuously monitored.
- 2 November 2019: the NPCIL chairman said the reactors are safe and being monitored by experts, and that cyber security details should not be discussed.
- 20 November 2019: the Minister of State told the Lok Sabha the Department of Atomic Energy’s advisory group and CERT-In concluded that the infection was limited to the administrative network.
Lessons
-
Do not deny before you check
The plant called the claim baseless on 29 October, and NPCIL confirmed the malware on 30 October. Check logs before you speak.
-
Keep the admin network apart
The official account says the administrative network is isolated from the critical network. Test that claim with a regular review, not only a statement.
-
Act on outside warnings
CERT-In flagged the matter on 4 September. The public confirmation came almost two months later. Set a clear path from an external warning to a fix.
-
Name what you found
NPCIL did not say which malware was found, so the public account stayed unclear. Say what you can, as early as you can.
-
Do not rely on the word standalone
The plant said the control systems were standalone. The infection was on a different network. Map every network and every link between them.
-
Plan communications
Three statements in three days differed in tone. Prepare one agreed account.
What to check in your own organization
-
Network map
Draw every network at your site and each link between them, including admin PCs, vendor access and removable media.
-
Isolation test
Confirm that the admin network cannot reach control systems, and test this at least yearly.
-
Internet-connected PCs
List PCs used for email and browsing on sites with critical operations. Limit what they can reach.
-
External alerts
Name one person who receives CERT-In style alerts and a way to check indicators in them within a day.
-
Logging
Keep logs long enough to answer an outside claim within hours.
-
Statement process
Agree who confirms or denies a security claim, and what must be checked first.
-
Removable media
Set rules for USB drives and laptops that move between networks.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country India India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025. Asia Pacific
Questions
What happened at Kudankulam in 2019?
Malware was found on an internet-connected administrative PC. NPCIL confirmed this on 30 October 2019 after researchers made claims on 28 October.
Did the malware reach the reactor controls?
NPCIL and the minister said no. DAE and CERT-In concluded the infection was limited to the administrative network. The sources opened give no independent check.
What malware was it?
Researchers named Dtrack, according to The News Minute. NPCIL did not name the malware in its release.
Who was behind it?
The government has not said. The News Minute reported Dtrack as reportedly developed by Lazarus, and MITRE notes similarities with a Lazarus-attributed campaign. This is not an attribution of the Kudankulam infection.
Did the plant deny it first?
Yes. Plant officials called the allegations baseless on 29 October 2019. NPCIL admitted the malware a day later.
Sources
- India's Nuclear Power Corporation confirms malware attack on system The News Minute
- NPCIL admits malware attack at Kudankulam plant, says plant systems not affected Onmanorama (PTI)
- Malware attack on Kudankulam nuclear plant: NPCIL press release The Logical Indian
- Reactors are safe, says NPCIL chairman Onmanorama
- Minister confirms details of Kudankulam cyberattack World Nuclear News
- Kudankulam cyber attack: MoS Jitendra Singh admits in Parliament The Quint
- ISRO malware attack alert and Kudankulam nuclear power plant The Quint
- Dtrack, Software S0567 MITRE ATT&CK
- Lazarus Group, Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY, Diamond Sleet, Group G0032 | MITRE ATT&CK MITRE
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.