Domains registered by Pak Malicious Actors
This document dated 04/09/2023 addresses the issue of domains registered by malicious actors in Pakistan under the “.in” domain, with the intention of targeting Indian Defence Personnel through spear phishing attacks. The document urges immediate action to block these malicious URLs, sensitize personnel about the risks, and forward suspicious emails for analysis. Controllers are instructed to ensure compliance with these guidelines and disseminate them within their respective offices.
“हर काम देश के नाम”
रक्षा लेखा महानियत्रक
उलान बटाररोड, पालम, दिल्ली छावनी-110010
Controller General of Defence Accounts
Ulan Batar Road, Palam, Delhi Cantt.- 110010
(IT&S Wing)
No. Mech/IT&S/810/Cyber Security/Misc
Date: 04/09/2023
Circular
To
All PCsDA/CsDA/PrIFA/IFA/PC A(Fys)
(through DAD WAN/email)
Sub: Domains registered by Pak Malicious Actors.
It has been observed that few websites have been registered under “.in” domain which are originally hosted by Pak based malicious actors. These websites are hosted to trap Indian Defence Personnel. The list of websites identified till date are as under :
| S. No. | Malicious Domain |
|---|---|
| a. | coorddesk.in |
| b. | ksboards.in |
| c. | dopt.ccordsec.in |
| d. | ksb.csl.in |
| e. | rsb.csl.in |
| f. | cgda.csl.in |
| g. | adminbr.in |
| h. | coordbranch.in |
| i. | coordbr.in |
| j. | e-admin.in |
| k. | admindesk.in |
| l. | ksbpanel.in |
2. Further research at national levels is in progress to identify more such domains. These domains can be used to launch spear phishing attacks against Armed forces.
3. In view of the above, the following actions are’to be taken immediately to contain spread of these campaigns:
» Block the malicious URLs mentioned at para 2 above at perimeter security devices of AFTI/JSOs.
» Sensitise all personnel under respective AOR regarding these phishing campaigns originating from these phishing domains and download applications only from trusted websites.
» Sensitise persons to not enter their NIC login credentials when redirected login page appears.
» Forward any: suspicious emails DCyA email ID (soc.ids@gov.in) without clicking on any link/opening any attachments/enter credentials for analysis and further guidelines.
» Post forwarding to DCyA, delete phishing emails from the inbox and
trash folders of all the recipients.
4. In view of the above, all the:Controllers are advised to ensure compliance of the guidelines given above and disseminate these guidelines to all their sections and sub offices for strict compliance.
(Neeraj burendran)
Sr. ACGDA (IT&S)
Source Document PDF