Canada cyber centre issues caution after group from India issues threat

Howard Solomon

1 year ago

The Canadian government’s cyber authority has issued a warning to IT administrators here to watch for attacks, after a group or individual claiming to be from India issued a retaliation threat over allegations India may have been behind the assassination of a Canadian man advocating for an independent Sikh state.

“CSE [the Canadian Security Establishment] and its Canadian Centre for Cyber Security (Cyber Centre) have observed that geopolitical events often result in an increase in disruptive cyber campaigns. We continue to monitor for any developing cyber threats and share threat information with our partners and stakeholders to help prevent incidents,” says the statement.

“However, the Cyber Centre’s primary focus is on defending Government of Canada networks from cyber threats. We focus on the type of threat, not where the threat originates. For that reason, we generally do not provide statistics, or information on reporting trends.

“We encourage Canadians and Canadian organizations to be aware of cyber threats and to remain vigilant.”

The statement came after IT World Canada asked the Cyber Centre if it had received reports or seen evidence of hacking groups based in India launching recent retaliatory attacks here.

According to Brett Callow, a B.C.-based threat analyst with Emsisoft, a group calling itself the Indian Cyber Force posted a threatening message last week on the X messaging platform. It says, “Get ready to feel the power of IndianCyberForce attacks will be launching on Canada cyber space in the coming 3 days. It’s for the mess your started.” [This is the actual wording of the posting]

A website with a .ca suffix that appears to belong to a Canadian dental clinic has been defaced with the message, “Hacked by Indian Cyber Force.” However, the real website, whose address begins with ‘www,’ isn’t affected. The defaced website has a similar name and could be a spoof. Or the dental clinic’s site was defaced and it quickly set up a new one. IT World Canada asked the site on Sunday for comment. None was received by our deadline.

“At this point it’s impossible to say whether this is an organized hacktivist operation or a lone high school kid,” Callow said of the threat. “Whatever the case, even the most unsophisticated cyberattacks have the potential to cause real-world problems, as the disruption caused by the recent DDoS attack on the Canadian Border Services Agency demonstrated.

“Given current geo-political tensions, all Canadian organizations should assume that they may be targeted and ensure their shields are fully up.”

As for why a dental website would be targeted, Callow suspects it was random: The site came up after a scan for vulnerable Canadian websites.

Website administrators must ensure their sites are fully patched and that admin access is restricted. That includes making sure management consoles aren’t available on the public internet unless shielded with VPN access and multifactor authentication for logins. Websites should also be prepared to deal with DDoS attacks.