Skip to content

Back to the catalog

KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE
theravenfile.comwriteup

KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE

An OSINT investigator analyzes a WorldLeaks ransomware group data leak of Reliance Infrastructure (hosted by third-party vendor Yotta), which exposed 14.3GB / ~19,000 files related to India's Kudankulam Nuclear Power Plant (KNPP) — including RFC drawings, PPS fencing designs, HVAC/fire specs, and vendor/employee records. The piece profiles WorldLeaks (a Hive/Hunters International spin-off), lists MD5/SHA-256 hashes for its RustyRocket exfiltration tool, and discusses supply-chain vendor risk, industrial espionage by nation-state actors (Lazarus/DPRK, China), and insider credential trading as threats to critical nuclear infrastructure.

TL;DR Ransomware group WorldLeaks breached Reliance Infra's hosting vendor Yotta, leaking sensitive engineering/security documents tied to India's Kudankulam Nuclear Power Plant.
Open original ↗

Organisations named here

  • Kudankulam Nuclear Power Plant (KNPP)
  • NPCIL
  • Rosatom
  • Yotta

Technologies named here

  • RustyRocket
  • Reliance Infrastructure
  • Yotta hosting servers
  • RDP

Techniques named here

  • Exposed RDP Access
  • Phishing
  • Fortinet Exploit
  • Data exfiltration via RustyRocket
  • Supply-chain attacks
  • AI Vishing
  • Fake Document Generation
  • GitHub Compromises
  • Fake Interviews
  • Known Vulnerability Exploitation
  • Insider Trading of credentials
  • File-less Malware
  • Industrial espionage / OT-ICS targeting
  • Document/vendor mapping for reconnaissance

Threat actors named here

  • WORLDLEAKS
  • Hunters International
  • Hive
  • Lazarus
  • Kairos Group
  • Lazarus Group
  • DPRK

Also named here

  • Reliance Infrastructure (RPOWER)

Related in Threat Intel