Power Play Gone Wrong: Kanpur’s KESCo Suffers 1.62 Crore Cyber Attack, 7 Arrested

KANPUR: In a breakthrough development, the Cyber Crime Branch of Kanpur has successfully cracked a major cyber fraud case involving a staggering amount of Rs 1.62 crore. The victim of this audacious crime is none other than the Kanpur Electricity Supply Co. (KESCo). The intricately woven scheme employed by the fraudsters has sent shockwaves through the cybersecurity landscape.

Sophisticated Operation Targeting KESCo

The targeted victim, KESCo, operates a significant web presence through its website Kesco.co.in, which was developed and maintained by Fluent Grid Co., a Hyderabad-based technology firm. As part of this agreement, Fluent Grid Co. charged a substantial fee of Rs 12 lakh per month for website maintenance.

KESCo’s website offered an online bill payment facility, with transactions directed to an ICICI bank account owned by KESCo. The payment gateway services were facilitated by ICICI bank itself, ensuring a seamless and secure payment process for the utility’s customers.

ALSO READ: Deepfake Nightmare: Sextortionists Resort To Morphed Dead Videos Of Girls For Higher Ransom

The Elaborate Ruse Unveiled

The criminals behind the fraud successfully created a parallel idebtity by developing an ICICI bank account named ‘KESCO Electronics’ and managed to obtain a payment gateway for it. The pivotal vulnerability exploited was the usage of a dynamic URL for payment processing. This dynamic URL allowed the perpetrators to manipulate transactions by generating a counterfeit dynamic URL, diverting funds into their fraudulent bank account through the gateway.

The crucial encrypted key that was entrusted to Fluent Grid Co. for the maintenance of the website and payment gateway was either compromised or misused by the cybercriminals to execute their illicit transactions.

ALSO READ: Surge in Cyber Crime Complaints Involving FedEx Parcels: Dehradun Cyber Police Issue Warning

Cracking Down on the Criminals

Upon discovering the fraud, KESCo filed a First Information Report (FIR), prompting the swift intervention of the Cyber Crime Branch. The investigative efforts led to the apprehension of 7 individuals believed to be directly involved in the cybercrime. Alongside the arrests, law enforcement managed to seize a significant cache of evidence, including 90.50 lakh in cash, 31 cell phones, 30 ATM cards, and 2 SUVs believed to be connected to the illicit activities.

Identifying Systemic Lapses

The investigation also highlighted several systemic lapses in KESCo’s cybersecurity framework, rendering it vulnerable to such a complex cyberattack. Some of these lapses include the disabling of firewalls and ports, the absence of maintained user logs, usage of an unsecured VPN, discrepancies between monthly and bank reports, the lack of an in-house technical support team, and inadequacies in the drafting and finalization of agreements. Notably, the utility also lacked a proper backup system, leaving it helpless when dealing with data loss or security breaches.

ALSO READ: Victim Of A Cyber Attack? Now Dial 1930 & 155260 To Register Complaint And Get Your Money Back

Implications for Fluent Grid Co. and Beyond

Fluent Grid Co., in addition to managing KESCo’s website, also oversees the website and billing software for other Uttar Pradesh Power Corporation Limited (UPPCL) companies. This vast customer base of 2.5 crore users faces a similar cybersecurity infrastructure, raising concerns about potential vulnerabilities across the entire network.

This incident underscores the pressing need for heightened cybersecurity measures and meticulous oversight when it comes to critical infrastructure entities. The KESCo fraud serves as a reminder that even seemingly sophisticated systems can be compromised by determined cybercriminals, warranting constant vigilance and proactive efforts to safeguard sensitive data and financial transactions.

Follow The420.in on

 Telegram | Facebook | Twitter | LinkedIn | Instagram | YouTube