Alixsec, BhinnekaSec, and AnonymousWorld collaborate to attack India

The coordinated efforts of some of the most notorious hacking groups, such as Alixsec, BhinnekaSec, and AnonymousWorld, have dealt severe implications for Indian websites since they share an agenda or ideology.

Their tactics range from distributed denial-of-service (DDoS) attacks to data breaches and website defacements, demonstrating a multifaceted approach aimed at disrupting services and compromising sensitive information.

In recent months, a disturbing trend has appeared in the digital landscape, as a series of cyberattacks has spread across various online platforms, targeting governmental, educational, media, and corporate entities. This orchestrated malicious operations by multiple hacking groups signifies a grave and persistent threat posed by coordinated hacktivist factions.

 

The primary targets of Alixsec, BhinnekaSec, and AnonymousWorld have originated from India.

 

The investigation of our iZOOlogic researchers revealed that the geopolitical undercurrent evident in the target selection of Alixsec, BhinnekaSec, and AnonymousWorld is of particular concern since 50% of the affected sites originate from India. This suggests motivations beyond mere mischief, featuring deeper political and ideological agendas.

Not content with disruption, these hacking groups utilised social media platforms and messaging applications to publicise their exploits, seeking notoriety, recruiting new members, and expanding their impact. These strategies are samples of the evolving abilities of cyber threats and the need for improved vigilance.

Furthermore, the earlier mentioned cybercriminal groups that are the main perpetrators of the campaigns have benefitted from other affiliates, such as LASHKAREMAHDI and 4 Exploitation.

One of our researchers spotted a defacement campaign against the alleged victim websites. The list featured more than 250 websites that the attackers claimed they compromised.

In addition, our researcher said the defaced websites displayed a 4 Exploitation message saying that the group locked the site. Numerous files, including .php, .css, .js, and others, were rendered inaccessible due to encryption.

The last part of the defacement screen showed that the actors urged the affected website owners to contact them to acquire decryption keys since it is the only way to unlock the websites.

The observed series of cyberattacks serves as a wake-up call for governments, businesses, and individuals alike, especially in India, since they are the primary targets of these hacker groups. Therefore, only through proactive measures and collective action can we hope to protect our digital infrastructure and maintain the integrity of online services for all.