One Hat Cyber Team Targets Indian Government Sites

Opportunistic hackers are leveraging the increasing tensions between religious groups in India to target their victims. An Indonesian hacker group, One Hat Cyber Team, is one of these groups, with a history of defacing various websites across the world. Recently, they have been relentlessly targeting Indian government websites. The group claims that the reason for this activity is to protest against the anti-Muslim violence caused by the recent Delhi riots.

Recommendations

Consider enabling the Cyber Attack Chatter rule to monitor developing threats to your organization
Continue monitoring the Alpha Team Tab for reports related to the dark web and threat actor activities.
For further assistance, reach out to [email protected]

Details

One Hat Cyber Team is an Indonesian hacker group known for defacing and hacking websites. ZeroFOX Alpha Team has tracked the group's activities, and has identified an uptick in activity intended to express solidarity with Muslim Indians who have been the target of violence in recent riots. These riots have broken out after rising tensions between Hindu and Muslim religious groups came to a head when legislation was passed, which prevents Muslims from gaining Indian citizenship. Protests against the Citizen Amendment Act, or CAA, have been ongoing. Although these protests were initially peaceful, some political groups have begun to incite violence against the majority-Muslim protesters.

One Hat Cyber Team has issued a warning to the government of India to stop the violence against Muslims in India or they will continue to hack and deface many more websites. Hacker groups like One Hat Cyber Team often target government websites to gain notoriety, spread a message, or achieve an agenda, as in this case.

Figure 1. Recent One Hat Cyber Team activity

The group started their cyber attacks on the Indian government by hacking and defacing a variety of Indian government sites starting on February 29, 2020, with the most recent defacement occurring on March 3, 2020. Compromised websites include a tourism site, a police site, and several other Indian government sites. The group tracks their defacement activity publicly, and posts a record of each defaced site on a popular website defacement forum. After the site is compromised, the below message is added to the front page, expressing solidarity with Muslims in India, and urging the Indian government to prevent future violence. As of March 07, 2020, none of the attacked websites have been recovered.

Figure 2. Indian government site hacked by the One Hat Cyber Team

The group is openly active on a variety of social media platforms including Facebook and Youtube, and also runs a blog where they host tools that can be used to deface websites. The Facebook page is used for similar content, and members discuss techniques for website defacement.

Figure 3. One Hat Cyber Team’s blog.

Conclusion

Less sophisticated or motivated attackers will often target companies that can't defend themselves properly, and then try to reap the benefits of this media exposure. In this case, the hacker group was politically motivated and was not looking to make any money by carrying out these attacks as they did not make any ransom demands. They did, however, seek to make a point politically in the message on the defaced site. Unfortunately, the lack of response of the targeted websites may give the attackers the confidence to continue this kind of defacement. To prevent attacks like these, website administrators should ensure they are restricting admin access as much as possible, regularly scan the site for malicious content, and use only modern plugins that are updated often.