Satan

Profile narrative

The threat actor known by the alias Satan has been linked to a cyber intrusion targeting Nepal’s .np domain infrastructure. Open‑source reporting indicates the actor is believed to be based in China, although this location is not independently verified beyond the provided context. The group gained entry by exploiting personal customer data obtained from the services Foodmandu, Vianet Communications and Prabhu Remit. Using that information they identified a security flaw in the domain management system operated by Mercantile Communications Pvt Ltd. This allowed them to claim unauthorized access to the .np domain servers on the night of April 13 2020. Mercantile noted that the majority of data on the server is publicly available via whois queries, but they suspended new registrations as a precaution.

Following the domain breach, the actor issued threats to compromise the networks of several Nepalese government and private organizations. Named targets included the Nepal Electricity Authority, Daraz Nepal, Kantipur Publication, the Nepal National Museum, district agriculture offices under the Department of Agriculture and the National Nepal Library. Specific threats referenced the electricity bills payment system, load dispatch centre and revenue system of the Nepal Electricity Authority. In response, the affected entities heightened their security posture and the Nepal Police Cyber Bureau opened an investigation to trace the perpetrators. No public attribution to a state sponsor or criminal consortium has been made, and the actor’s malware families, tooling or broader campaign history remain undisclosed in the available sources. The incident is therefore recorded as a standalone operation that highlighted weaknesses in Nepal’s ICT safeguards and prompted calls for greater investment in defensive measures.

Incidents

Attributed incidents are available to members.