Highlights:
- According to Cyber intelligence firm Cyfirma, Chinese state-backed hacking group has targeted IT systems of Indian vaccine makers Serum Institute of India & Bharat Biotech
- The hacker group is said to have found flaws in both companies’ IT infrastructure and supply chain software
- More than 60% of all vaccines sold worldwide are manufactured in India
According to cyber intelligence firm Cyfirma, a Chinese state-backed hacking group has attacked the IT systems of two Indian vaccine makers whose coronavirus shots are used in the country’s immunisation campaign in recent weeks.
Many countries have purchased or gifted COVID-19 shots from China and India. More than 60% of all vaccines sold in the world are manufactured in India.
Bharat Biotech and the Serum Institute of India (SII), the world’s largest vaccine manufacturer, said Chinese hacking group APT10, also known as Stone Panda, had found loopholes and weaknesses in their IT infrastructure and supply chain software, according to Goldman Sachs-backed Cyfirma, based in Singapore and Tokyo.
Cyfirma CEO Kumar Ritesh, a former top cyber official with the British foreign intelligence agency MI6 said, “The real motive here is to steal intellectual property and gain a strategic edge over Indian pharmaceutical firms.”
He stated that APT10 was concentrating its attention on SII, which manufactures the AstraZeneca vaccine for a number of countries and will soon begin mass-producing Novavax shots.
Mr Ritesh explained, “In the case of Serum Institute, they discovered a number of their public servers running weak web servers, which are vulnerable web servers.”
He added, “They’ve mentioned a flaw in the web application, and they’ve also mentioned a flaw in the content management system. It’s quite alarming.”
Also Read: Rental Of Luxury Homes In 2020 Went Up Despite Little To No Change In Purchase Prices
A request for comment from China’s foreign ministry was not immediately returned.
Bharat Biotech and SII declined to comment. Cyfirma said it had shared its findings with the government-run Computer Emergency Response Team, but the group is yet to response.
In 2018, APT10 partnered with the Chinese Ministry of State Security, according to the US Department of Justice.
In November, Microsoft revealed that it had discovered cyber-attacks targeting COVID-19 vaccine companies in India, Canada, France, South Korea, and the United States. North Korean hackers attempted to hack into the networks of AstraZeneca, a British pharmaceutical company, according to Reuters.
Mr Ritesh, whose firm uses a tool called decipher to track the activities of 750 cyber criminals and monitor nearly 2,000 hacking campaigns, said it was unclear what vaccine-related data APT10 obtained from the Indian firms.
The COVAXIN shot developed by Bharat Biotech in collaboration with the Indian Council of Medical Research will be exported to a number of countries, including Brazil.
Pfizer Inc. of the United States and BioNTech SE of Germany revealed in December that information related to the development of their COVID-19 vaccine had been “unlawfully accessed” in a cyberattack on Europe’s medicines regulator.
