Income-tax department hacked
A couple of weeks ago data of the Income-tax department was hacked, a hacker identified as “Bassterlord” claimed to possess administrator access to the network of a collection office in India.
In his post, on a Russian-speaking hacking forum, it are often seen that the hacker mentions that this network is formed from four devices that store 800 GB of state information. Bassterlord adds that he’s accepting requests through communication channels like Telegram, his personal email and therefore the hacking forum itself.
The writing of this post isn’t ok , so cybersecurity experts are unclear if the hacker is selling the leaked data or simply the compromised system access credentials. However, as proof of the hack, Bassterlord posted five screenshots; after being analyzed, the experts concluded that the incident is real.
Below is an analysis of each of the screenshots posted by the hacker.
1. the vendor tries to means that the state tax office system was hacked.
This screenshot shows that the system has 3 storage units:
According to specialists, it’s practically impossible to extract 800 GB of knowledge without attracting attention, so it’s presumably that the hacker is merely selling access to the present network, not the info.
Some of the sensitive file names are:
- Tele doc.xls
- Telephone Nos off…
The upper left corner of the screenshot has Russian text that translates as “Remote Desktop Connection”. The hacker likely gained access to the Remote Desktop tool to take advantage of a foreign code execution flaw, using the default RDP credentials or using brute force.
2. the seller tries to form this appear as if proof that they really do have administrator rights on the affected system.
The arrow during this screenshot points to a folder on the desktop named “admin”, indicating that the threat actor could have logged into the target system using the administrator’s login credentials.
3. consistent with the vendor , this is often a test of access to confidential documents within the target system. The image below may be a Provisional Registration Certificate, for P N Goradia & Co. we will also note that the certificate has been issued by the Gujarat Government. this might mean that the threat actor could have access to an area tax office in India.
The details of P N Goradia & Co on the certificate match the knowledge on indiamart.com:
P N Goradia & Co.No.
Address: 302, Taksh Classic ahead of the IOC fuel pump, Vasna Road, Vasna Road,
Vadodara-390007, Gujarat, India
4. the vendor assures that this is often evidence of access to some confidential documents. The image belongs to Vishmit Enterprise’s Permanent Account Number (PAN) card.
After doing a touch more research, cybersecurity experts discovered that this PAN card was active, but didn’t match the Vishmit Enterprise data recorded within the PAN database. However, if the name is modified to Vismit Enterprise, without the “h”, the PAN key matches the name within the database. This shows that this PAN key’s active.
5. The hacker ensures that he has further evidence of his access to confidential documents. the newest screenshot published by Bassterlord contains confidential details like phone numbers, email addresses, dates, and other details about companies not found on the web . The researchers took a sample of those phone numbers and located that they really belong to some private companies in India, specifically within the State of Gujarat.
According to the forum where this information was published, Bassterlord has 14 reputation points on this platform and, so far, nobody seems to possess filed any complaints against him. A striking detail is that, in but a year, Bassterlord has positioned itself together of the trusted members of the forum.
The hacker appears to possess remotely accessed other systems on previous occasions. For example: on March 23, 2020, the user was selling remote access to some private companies in India. thanks to its history, the researchers consider that the hacker is very likely to sell legitimate accesses.
Based on the analysis, specialists suppose that the hacker actually gained access to the tax office server, exploiting some known vulnerabilities. The hacker mentions that 4 network devices are compromised and a screenshot shows shared network drives. Therefore, the hacker may have made lateral movements to compromise other systems on the network.