Cyberespionage group ‘Suckfly’ targeted Indian government networks: Report

NEW DELHI: Cybersecurity firm Symantec has claimed that an advanced cyberespionage group called Suckfly conducted long term espionage campaigns against high profile targets, including government and commercial organizations in India.

Symantec identified a number of cyber attacks over a two-year period, starting April 2014. These attacks occurred in several countries. As per the firm’s investigation, the chief targets were individuals and organizations located primarily in India.


“The Indian targets show a greater amount of post-infection activity than targets in the other regions. This suggests that these attacks were part of a planned operation against specific targets in India,” Symantec said in a statement.

The report by Symantec claimed that Suckfly spent more time attacking the government networks as compared to commercial targets.

One of the attacks Symantec investigated provided detailed insight into how Suckfly conducts their operations. In April 2015, the cyberespionage group conducted a multistage attack against an e-commerce organization based in India. Similar to their other attacks, Suckfly used the Nidiran backdoor and a number of other hack tools to infect the victim's internal hosts. The tools and malware used in the breach were also signed with stolen digital certificates.


Suckfly has the resources to develop malware, purchase infrastructure and conduct targeted attacks for years, while staying off the radar of security organizations.

Symantec believes that “Suckfly will continue to target organizations in India, and similar organizations in other countries to provide economic insight to the organization behind its operations.”