14 Sep, 2023 10:33 AM

CGDA: Phishing websites by Pak based malicious actors to to trap Indian Defence Personnel

Controller General of Defence Accounts
Ulan Batar Road, Palam, Delhi Cantt.- 110010
(IT&S Wing)

No. Mech/IT&S/810/Cyber Security/Misc

Date: 04/09/2023

Circular

To

All PCsDA/CsDA/PrIFA/IFA/PC A(Fys)
(through DAD WAN/email)

Sub: Domains registered by Pak Malicious Actors.

It has been observed that few websites have been registered under “.in” domain which are originally hosted by Pak based malicious actors. These websites are hosted to trap Indian Defence Personnel. The list of websites identified till date are as under:

S. No.	Malicious Domain
a.	coorddesk.in
b.	ksboards.in
c.	dopt.ccordsec.in
d.	ksb.csl.in
e.	rsb.csl.in
f.	cgda.csl.in
g.	adminbr.in
h.	coordbranch.in
i.	coordbr.in
j.	e-admin.in
k.	admindesk.in
l.	ksbpanel.in

2. Further research at national levels is in progress to identify more such domains. These domains can be used to launch spear phishing attacks against Armed forces.

3. In view of the above, the following actions are’to be taken immediately to contain spread of these campaigns:

» Block the malicious URLs mentioned at para 2 above at perimeter security devices of AFTI/JSOs.

» Sensitise all personnel under respective AOR regarding these phishing campaigns originating from these phishing domains and download applications only from trusted websites.

» Sensitise persons to not enter their NIC login credentials when redirected login page appears.

» Forward any: suspicious emails DCyA email ID without clicking on any link/opening any attachments/enter credentials for analysis and further guidelines.

» Post forwarding to DCyA, delete phishing emails from the inbox and trash folders of all the recipients.

4. In view of the above, all the:Controllers are advised to ensure compliance of the guidelines given above and disseminate these guidelines to all their sections and sub offices for strict compliance.

(Neeraj burendran)
Sr. ACGDA (IT&S)

Read the source: CGDA