Hacktivists Launch Coordinated Attacks on India’s Infrastructure

According to CYFIRMA, India’s digital infrastructure faced an unprecedented surge in cross-border hacktivist operations during July–August 2025, combining breaches, disruptions, phishing and advanced malware against judicial, defence and transport sectors. The analysis identifies coordinated campaigns from Pakistan, Bangladesh, Russia, Indonesia and likely China targeting Indian institutions, marking a shift from isolated attacks to multi-nation operations against India’s digital infrastructure.

Among the incidents, the breach of High Court servers in Punjab & Haryana and Andhra Pradesh is highlighted, with Pakistani group Team Insane Pakistan allegedly compromising millions of case records, FIRs and login credentials, and deriding the judiciary. The report notes a DDoS on the Ministry of Defence website on India’s Independence Day by Sylhet Gang‑SG, and mentions a Russian-aligned group, RuskiNet, pre-signalling its “Operation Trinetara” in connection with the Palestine conflict.

It also details phishing campaigns masquerading as Income Tax penalties, including a 43 MB malware installer dubbed 103.97.128.77#ClientSetup.exe, with persistence via process injection and C2 connections to a suspicious IP address.