‘Netting’ the enemy: Pakistan’s cyberwar, India’s new headache

In recent weeks, developments in  Afghanistan, Pakistan’s uninhibited  involvement in setting up the Taliban  cabinet and its purported role in escalating violence in Kashmir have held  the attention of Indian policymakers.

Beyond this, however, is another  serious threat to India’s security  interests: multiple cyberattacks from  Pakistan-based hacker groups targeting India’s critical infrastructure and  government servers. These attacks  eclipse the earlier ‘nuisance value’  acts of vandalising Indian websites  – a regular Pakistani habit. The new  attacks demonstrate a step-up of  Pakistan’s cyber capabilities and work  concurrently with its persistent antiIndia cyber disinformation campaigns  like those pertaining to Kashmir and  Indian interests in Afghanistan. Now  is the time for India to neutralise the  Pakistani cyber threat before it assumes menacing proportions.

Pakistan is getting there. In early  August, the U.S.-based cybersecurity  firm Black Lotus Labs reported that  a Pakistan-origin malware called ‘ReverseRat 2.0’ had targeted Indian government officials by sending a forged  invite for a United Nations meeting  on organized crime with a Microsoft  Teams link. Its impact is still not  known. ReverseRat 2.0 can breach the  device of its intended victims, and the  malware can remotely click photographs via its webcams, even retrieve  files from USB devices plugged into  the infected device. According to  Black Lotus Labs, this is an advanced  version of Pakistan’s earlier malware  ‘ReverseRat’, detected just two months  prior in June 2021 targeting India’s  power sector and government departments. India has been on the radar of  Pakistani hackers for some time.  In 2020, security researchers from  Ireland-based Malwarebytes Labs  cybersecurity firm noticed attempts  from a hacking group, APT36 – a  Pakistani state-sponsored malicious  actor, to infiltrate Indian government,  diplomatic and military networks, and  honey trap defence personnel for stealing sensitive data related to Pakistani  military and diplomatic interests. Its  modus operandi involved spear phishing emails with a malicious link, purportedly from the Indian government.  The group has been active since 2016,  indicating its long cyber espionage  campaign.

Pakistan’s recent anti-India cyber  activity must be viewed in the backdrop of its new Cyber Security Policy  2021, which seeks to position Pakistan  as an important participant in the  global conversation on cybersecurity.  While the new policy does not explicitly mention the pursuit of cyber  offensive capabilities for pre-emptive  use, it does display more teeth in its  messaging to Pakistan’s potential adversaries than the earlier Prevention  of Electronic Crimes Act, 2016. Whereas the 2016 Act’s stated  objective was to control the escalation of cyber offences in Pakistan and  transgressions related to information  systems, the most significant assertion in the recent law is that any  cyberattack on a Pakistani establishment will hereafter be treated as an  assault on Pakistan’s sovereignty and  invite suitable retaliation. Unsurprisingly, the document has no clarity on  the nature of retaliation, and whether  it will be implemented using cyber  offensive campaigns or more conventional methods. From India’s perspective, it may  appear that committing to retaliation  in the cyber domain might not be sufficient to deter Pakistan’s adversaries  given its limited cyber capabilities.  But it is more likely that the actual  objective of this vagueness is to grant  Pakistan flexibility and unpredictability in its retaliation.

Although Pakistani hacking activities against India lack the sophistication of Chinese state-sponsored  hacking groups, it is compensated for  by the tenacity of the well-designed  and catchy propaganda unleashed  by Inter-Services Public Relations of  the Pakistani Army, such as in the  aftermath of the August 2019 abrogation of Article 370 and bifurcation  of India’s erstwhile state of Jammu  and Kashmir. For this, it utilised fake  profiles, cyber trolls, journalists, and  Pakistani diplomats, focussing on  themes such as alleged human rights  violations by Indian security forces  in the Kashmir Valley, the plight of  ordinary Kashmiris, scaremongering  on the possibility of an India-Pakistan  nuclear war, etc. This propaganda