Loading story…
A China-linked intrusion set tracked as RedEcho targeted India’s power sector and other critical infrastructure, with activity beginning in early 2020 and intensifying from mid-2020. Recorded Future observed Indian power-sector entities communicating with infrastructure associated with AXIOMATICASYMPTOTE and ShadowPad command-and-control servers, indicating a sustained campaign against high-value operational targets.
The activity affected 10 distinct Indian power organizations, including 4 of India’s 5 Regional Load Despatch Centres, and also extended to two Indian seaports. Researchers assessed the campaign as more consistent with strategic pre-positioning inside critical infrastructure than ordinary economic espionage, raising concern that the access could support signaling, influence operations, or future disruptive action amid India-China tensions; while the infrastructure and victimology overlapped with groups such as APT41/Barium and Tonto Team, the operation was tracked separately as RedEcho because attribution remained inconclusive.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On 2021-02-28, Recorded Future published research describing the RedEcho campaign and assessing it as strategic pre-positioning in Indian critical infrastructure rather than economic espionage. The report said the activity overlapped with infrastructure and victimology associated with Chinese state-sponsored groups but was tracked separately as RedEcho.
Recorded Future observed a sharp increase from mid-2020 in AXIOMATICASYMPTOTE infrastructure, including ShadowPad command-and-control servers, communicating with Indian power-sector entities. The targeting included four of India’s five Regional Load Despatch Centres.
Recorded Future reported that a China-linked campaign it tracks as RedEcho began targeting India’s power sector and other critical infrastructure in early 2020. The activity included targeting 10 Indian power organizations and two Indian seaports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked threat activity was reported against both critical infrastructure in India and diplomatic targets in Europe, with researchers describing sustained espionage and pre-positioning operations rather than confirmed destructive attacks. Recorded Future’s Insikt Group said intrusions hit seven Indian State Load Dispatch Centers near the disputed Ladakh border, as well as India’s national emergency response apparatus and an Indian logistics subsidiary, using **ShadowPad** malware, compromised DVR/IP camera devices for command-and-control, and the **FastReverseProxy** tool. The activity was assessed as likely intended to establish access and collect intelligence inside India’s power sector. Separately, Proofpoint said China-aligned actor **TA416** increased operations against European diplomatic entities as Russia-Ukraine tensions escalated, including targeting a person involved in refugee and migrant services. The campaigns used web bugs to confirm active recipients before sending malicious links that ultimately deployed updated **PlugX** malware through ZIP archives, droppers, and DLL search-order hijacking. Proofpoint found substantial overlap between TA416 and the publicly reported **Red Delta** cluster, while Beijing publicly denied involvement in the India-related accusations and said it opposes cyberattacks.
Aug 15, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026