Indian Cyber Force

Profile narrative

Indian Cyber Force is the primary alias used by a hacking group that has been publicly linked to India in open‑source reporting. The group’s location is noted as India, and it operates under the name Indian Cyber Force in its claims and communications. Its activities have been directed primarily at Canadian government entities and associated public services, including the Canadian Armed Forces website, the House of Commons portal, Elections Canada, and The Ottawa Hospital, as well as at small‑business websites such as restaurants and medical clinics in the Ottawa area. The stated purpose of these actions, as expressed in the messages left on compromised sites, is to convey political messaging related to bilateral tensions between Canada and India, indicating a strategic objective of disruption rather than financial gain or espionage.

Observed tactics, techniques, and procedures involve distributed denial‑of‑service attacks that render target websites temporarily inaccessible, coupled with website defacements that display a black background with green digits reminiscent of the film “The Matrix” while warlike music plays. The defaced messages contain deliberate spelling and grammatical errors and reference specific geopolitical events, such as allegations concerning a Sikh activist’s killing. The group has used the Telegram platform to publish claims of responsibility and to share altered statements, and it has asserted infiltration of a handful of small‑business sites to host its propaganda. No specific malware families, exploit kits, or initial‑access vectors are described in the available sources; the activity is characterized by cybersecurity observers as unsophisticated cybervandalism focused on service interruption and visual alteration.

A representative campaign occurred in September 2023 under the hashtag #OpCanada, during which Indian Cyber Force claimed responsibility for a series of DDoS attacks that disrupted the Canadian Armed Forces site, the House of Commons website, Elections Canada, and The Ottawa Hospital’s external pages, alongside defacements of various small‑business domains. The group linked these actions to public statements made by Canadian leadership regarding India’s alleged involvement in the killing of Hardeep Singh Nijjar, using the incidents to amplify its political narrative. Canadian officials acknowledged the disruptions as nuisance events with no evidence of deeper system compromise or data theft, and signals‑intelligence agencies noted the increase in disruptive cyber activity coinciding with the geopolitical flare‑up while refraining from confirming direct state sponsorship. No public evidence has been presented tying Indian Cyber Force to a state apparatus or a broader criminal consortium.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.