In September 2019, the Nuclear Power Corporation of India Limited confirmed that malware had infected the information-technology network at the Kudankulam nuclear power plant. The incident came to light after a file containing traces of Dtrack was uploaded to a cybersecurity firm’s website; India’s Computer Emergency Response Team detected the malware on a computer connected to the plant’s administrative network. Reports said the attackers had obtained administrator credentials and used the infection to gather information about the network.
NPCIL stated that the malware did not reach the operational-technology network controlling critical plant systems. Investigators described the payload as primarily information-stealing: it collected browser search history, operating-system registry details and active-process lists, writing the information to temporary files for extraction by a remote server. The malware was reportedly linked to the North Korea-associated Lazarus Group, though the source does not describe a public prosecution or definitive judicial attribution. The breach was consequential because it showed that a critical nuclear facility could be penetrated through its corporate or administrative environment even without confirmed access to reactor-control systems.
