Indian Central Board of Higher Education Compromised by Team Mysterious Bangladesh

December 5, 2022

•

min read

Category:

Adversary Intelligence

Industry:

Government

Motivation:

Hacktivism

Country:

India

Source*:

D: Not usually reliable

1: Confirmed by independent Sources

Executive Summary

THREAT	IMPACT
Hacktivist group MT Bangladesh claims to have compromised the Central Board of Higher Education (CBHE), Delhi. Sensitive information such as name, Aadhar number, IFSC code, and other PII details of numerous individuals compromised.	The data can be exploited for conducting fraudulent scam campaigns. Social Engineering & Phishing attempts against affected entities or individuals.

CloudSEK’s contextual AI digital risk platform XVigil, discovered a threat actor group named Team Mysterious Bangladesh who claimed to have compromised the CBHE Delhi, India. The group mentioned leaking information about students from 2004 to 2022.
The actor shared a snapshot of the data for a student as depicted below in the images

For CBHE Delhi (https://www.cbhedelhi.com/), the admin panel of the site is exposed and can be discovered with a mere google dork. This site enables any individual to see results of all students from the year 2004 to 2022 and even delete or add records.
Hence, the actors gained unauthorized access to the admin panel enabling them to compromise the data for CBHE Delhi India.
Additionally, a directory of the domain was compromised by the hacktivist as they defaced it with their names.

Threat Actor Profiling
Active since	May 2021
Reputation	Intermediate
Current Status	Targeting Iran under #OpIran & #FreeIran2022
History	Known for using various scripts for DDoS attacks and exploiting the HTTP flooding attack technique, similar to DragonForce. “./404found.my”, a tool previously used by Dragonforce to target Indian government websites, could have been used to conduct the attacks. Additional details and analyses of the tool have been conducted in the TTP report of the DragonForce group.
Rating	D1 (D: Not usually reliable; 1: Confirmed by independent Sources)

Impact	Mitigation
The leaked information could be used to gain initial access to the company’s infrastructure. Commonly used passwords or weak passwords could lead to brute force attacks. It would equip malicious actors with details required to launch sophisticated ransomware attacks, exfiltrate data, and maintain persistence.	Patch vulnerable and exploitable endpoints. Do not store unencrypted secrets in .git repositories. Monitor for anomalies in user accounts, which could indicate possible account takeovers. Monitor cybercrime forums for the latest tactics employed by threat actors.

Tags:
‍

No items found.