Pierluigi Paganini November 06, 2016

The databases of the Indian Embassies in Switzerland, Mali, Romania, Italy, Malawi, and Libya were leaked online by two grey hat hackers.

Today I was contacted by a security pentester who goes online with the moniker Kapustkiy who revealed me to have breached the Indian Embassies in Switzerland, Mali, Romania, Italy, Malawi, and Libya. Kapustkiy and his friend Kasimierz (@Kasimierz_) told me that they were initially white hats in the past, but decided to change to grey hats to get the media attention and force many administrators of websites online to seriously consider cyber security.

They breached a total of 7 databases containing names, surname, email addresses and telephone numbers.

The duo leaked online the content of the hacked databases. The data are available on Pastebin at the following URL

http://pastebin.com/GqJcwSSc 

Unfortunately, such kind data leaks are very dangerous, especially for the security of diplomatic personnel. We cannot forget that the personnel working in the embassies are privileged targets of nation-state actors conducting cyber espionage campaigns.

In May, security experts from PaloAlto Networks collected evidence that the Operation Ke3chang discovered by FireEye in 2013 is still ongoing. Back in 2013, the security researchers at FireEye spotted a group of China-Linked hackers that conducted an espionage campaign on foreign affairs ministries in Europe. The campaign was named ‘Operation Ke3chang,’ and in March the same hacking crew was spotted targeting personnel at Indian embassies across the world.

The Operation Ke3chang is only one of the numerous campaigns that targeted diplomats worldwide, for this reason, it is important to ensure a proper security posture to secure data managed by embassies across the world.

Now the data belonging to the personnel working in the Indian Embassies in the above countries are available online.

I had no opportunity to check the authenticity of the data, I tried to reach the embassy online but at the time I was writing the website of the Indian Embassy in Rome is unavailable.

Update

All the websites are down a few hours after the data leaks. Data appears to be legitimate.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Indian embassies , data breach)