SofTeCode Blogs

One Place for all Tech News and Support

Indian Income-tax department hacked

4 min read
Indian income tax department

image credit income tax department


Income-tax department hacked

A couple of weeks ago data of the Income-tax department was hacked, a hacker identified as “Bassterlord” claimed to possess administrator access to the network of a collection office in India.

income tax department hacked

In his post, on a Russian-speaking hacking forum, it are often seen that the hacker mentions that this network is formed from four devices that store 800 GB of state information. Bassterlord adds that he’s accepting requests through communication channels like Telegram, his personal email and therefore the hacking forum itself.

The writing of this post isn’t ok , so cybersecurity experts are unclear if the hacker is selling the leaked data or simply the compromised system access credentials. However, as proof of the hack, Bassterlord posted five screenshots; after being analyzed, the experts concluded that the incident is real.

Below is an analysis of each of the screenshots posted by the hacker.

1. the vendor tries to means that the state tax office system was hacked.

This screenshot shows that the system has 3 storage units:

According to specialists, it’s practically impossible to extract 800 GB of knowledge without attracting attention, so it’s presumably that the hacker is merely selling access to the present network, not the info.

Some of the sensitive file names are:

  • Export_Tax
  • Tele doc.xls
  • Tele-Directory
  • Telephone Nos off…
  • life_time_cal..
  • mobile_introductory
  • Book1.xlsx
  • RomeshAshokbh…
income-tax department data sheet
Source CloudSek

The upper left corner of the screenshot has Russian text that translates as “Remote Desktop Connection”. The hacker likely gained access to the Remote Desktop tool to take advantage of a foreign code execution flaw, using the default RDP credentials or using brute force.

2. the seller tries to form this appear as if proof that they really do have administrator rights on the affected system.

The arrow during this screenshot points to a folder on the desktop named “admin”, indicating that the threat actor could have logged into the target system using the administrator’s login credentials.

3. consistent with the vendor , this is often a test of access to confidential documents within the target system. The image below may be a Provisional Registration Certificate, for P N Goradia & Co. we will also note that the certificate has been issued by the Gujarat Government. this might mean that the threat actor could have access to an area tax office in India.

The details of P N Goradia & Co on the certificate match the knowledge on

P N Goradia & Co.No.
Address: 302, Taksh Classic ahead of the IOC fuel pump, Vasna Road, Vasna Road,
Vadodara-390007, Gujarat, India

4. the vendor assures that this is often evidence of access to some confidential documents. The image belongs to Vishmit Enterprise’s Permanent Account Number (PAN) card.

After doing a touch more research, cybersecurity experts discovered that this PAN card was active, but didn’t match the Vishmit Enterprise data recorded within the PAN database. However, if the name is modified to Vismit Enterprise, without the “h”, the PAN key matches the name within the database. This shows that this PAN key’s active.

5. The hacker ensures that he has further evidence of his access to confidential documents. the newest screenshot published by Bassterlord contains confidential details like phone numbers, email addresses, dates, and other details about companies not found on the web . The researchers took a sample of those phone numbers and located that they really belong to some private companies in India, specifically within the State of Gujarat.

According to the forum where this information was published, Bassterlord has 14 reputation points on this platform and, so far, nobody seems to possess filed any complaints against him. A striking detail is that, in but a year, Bassterlord has positioned itself together of the trusted members of the forum.


ITR3 Indian Income-tax department hacked

The hacker appears to possess remotely accessed other systems on previous occasions. For example: on March 23, 2020, the user was selling remote access to some private companies in India. thanks to its history, the researchers consider that the hacker is very likely to sell legitimate accesses.

Based on the analysis, specialists suppose that the hacker actually gained access to the tax office server, exploiting some known vulnerabilities. The hacker mentions that 4 network devices are compromised and a screenshot shows shared network drives. Therefore, the hacker may have made lateral movements to compromise other systems on the network.


How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

Give your views

This site uses Akismet to reduce spam. Learn how your comment data is processed.