The hacker identified himself as John Wick.
“Yes this account is hacked by John Wick,” read one tweet posted on @narendramodi_in connected to the Prime Minister’s personal website.
The compromised account then posted several tweets asking people to donate cryptocurrency.
WHO IS JOHN WICK?
John Wick appears to be a reference to a fictitious action-movie character played by Hollywood icon Keanu Reeves, who coincidently turned 56 on September 2.
The film though features Keeves as a much-feared assassin — and not a cyber hacker — whose violent mission continues in the third chapter of the franchise released last year.
Twitter is investigating the hack of @narendramodi_in.
But based on available information, this attack bears at least some hallmarks of similar events in the past.
The hacker used the John Wick and the encrypted and the encrypted [email protected] email aliases.
HCKIndia is a pseudonym allegedly responsible for a number of ransomware attacks in the past. This group is also known as Korean Hackers in cyberspace forums.
One of the tweets from the compromised @narendramodi_in claimed those who hacked the PM-linked account were not responsible for the alleged Paytm Mall hack on August 30.
An account claiming to represent the hackers had openly advertised that it breached the Paytm Mall security walls in a Russian cyber forum.
An organization that specializes in cyber and risk intelligence, Cyble, had first claimed that a group that calls itself John Wick was behind its hack.
Those claims were, however, refuted strongly by Paytm.
But cybersecurity circles connect the same group with data theft and hacking incidents related to numerous firms like SquareYards, Stashfin, Sumo Payroll, Square Capital, i2ifunding, e27 and many more.
CRYPTOCURRENCY SCAM LIKE JULY?
In July, Twitter saw a large-scale breach in which accounts of the likes of Uber, Apple, Elon Musk, Barack Obama, Kanye West and Joe Biden were compromised.
Back then, cybercriminals lured the followers into transferring Bitcoins to a specific wallet by offering double the value in return.
In July, the hackers amassed around $120K worth of cryptocurrency sent to the designated account by gullible twitter followers of the compromised handles.
Authorities have since arrested the alleged mastermind, a 17-year-old suspect named Graham Ivan Clark, along with two other people — a 19-year-old Briton and a 22-year-old man from Orlando, Florida. They have been charged under the US federal law with aiding the attack.
But unlike the hacking event of July 2020, this time there were no major transactions reported. Given the nature of blockchains, it’s extremely hard to ascertain the origins and destination of any financial activity.
It is also hard to determine if any of the followers made that transaction as hacked tweets have already been deleted and the account restored.
THE MODUS OPERANDI
During the Twitter hack in July, the hackers accessed internal systems of Twitter to virtually take over accounts of some of the top names in the US, including presidential hopeful Joe Biden, former US president Barack Obama and billionaire Elon Musk.
There are a few major possibilities via which this could have happened:
- A compromise at Twitter’s end from within — similar to the 2017 incident in which a customer-support worker shut down Donald Trump’s account for 11 minutes. Soon after, the President’s account was provided with an additional layer of security mechanisms.
- A targeted attack because no other account was compromised — unlike the July event when the security of Twitter’s internal systems was breached to access top handles.
- Investigators might also probe whether PM Modi’s personal website or mobile application was hacked to carry out this attack.
Looking at the past incidents of the John Wick aka HCKIndia group aka Korean hackers, it is clear that they mostly do what they do in return for ransomware.
According to their reported track-record, their modus-operandi mostly involves gaining unrestricted access to entire databases of the targeted organizations and demand ransom in exchange.
They either make money by getting the ransom amounts paid by the targeted companies or resort to selling sensitive data to competitors or those who have some use for such data.
They usually want the ransom to be in the form of cryptocurrencies. A report by Cyble claimed that the group demanded 10 ETH (equivalent to $4,800 as of today) from a single company as ransom.
The group typically operates from 1:30 pm UTC to 8:30 pm UTC (or 7:30 pm to 2:30 am IST). This is close to the timing we saw this latest event play out.
THE CRYPTOCURRENCY CONNECTION
In March, the Supreme Court lifted a blanket ban on cryptocurrency trade.
It also might be worth investigating if the hackers are looking to boost cryptocurrency trading by posting misleading messages from government accounts.
THE HACKING CHRONOLOGY
The first hacked tweet was posted at 3:09 a.m. IST (September 3, 2020), after which a series of tweets were posted from the @narendramodi_in handle.
In the first tweet, the hacker asked the followers of the account to donate generously to the PM National Relief Fund for Covid-19 and posted addresses of wallets for followers to donate.
The hacker posted two wallet addresses, one each for Bitcoin and Ethereum, the world’s second-biggest cryptocurrency.
The tweets were not well constructed, something which may have raised suspicion.
In the last tweet posted at around 3:16 a.m., the hacker identified himself or his group as John Wick.
“We have not hacked Paytm Mall,” declared a post from the compromised handle. The tweets were later removed at around 4:05 am IST.
