The incident. The extortion group World Leaks published ~858,000 files it attributes to Reliance Infrastructure (a Kudankulam Balance-of-Plant contractor) on its dark-web leak site, live since 11 June 2026. The compromised asset was a Reliance-owned server colocated at a third-party data-centre provider; the provider detected and terminated suspicious activity on 29 May. ~19,000 files match the plant acronym "KKNP" — a subset of a broader corporate data loss. No nuclear safety/security systems were involved.
Timeline
| ~24–25 May | Intrusion window (leak-site metadata; approximate) |
| 29 May | The data-centre provider detects & terminates suspicious activity on the Reliance server; says it prevented ransomware execution |
| 11 Jun | Reliance listed on the World Leaks DLS; ~858,000 files online |
| late Jun | Reliance informs the provider of the external theft claims — ~1-month detection-to-relay gap |
The actor
World Leaks is the Hive → Hunters International lineage, relaunched Jan 2025 as an extortion-only, affiliate-based operation (80% affiliate split; targeting varies by affiliate). It usually deploys no encryptor — so there is no ransom-note event and almost no malware/IOC footprint (confirmed across multiple feeds; no ThreatFox IOCs, no C2). Affiliates use a self-developed exfil tool and run a DLS, a negotiation portal, and a "journalist portal" giving media 24-hour early access. Detection must be behavioural, not signature-based.
TTPs (MITRE ATT&CK)
| Initial Access | T1078 Valid Accounts · T1133 External Remote Services — compromised VPN/portal credentials without MFA (primary); T1566 Phishing · T1190 Exploit Public-Facing Application (secondary) |
| Discovery | T1083 File/Directory Discovery · T1087 Account Discovery |
| Collection | T1005/T1039 Data from Local & Network Shares · T1560 Archive Collected Data |
| C2 | T1090 Proxy over Tor (SOCKSv5) — no traditional beaconing |
| Exfiltration | T1567 Exfil Over Web Service — custom tool; data staged to affiliate infra / consumer cloud (e.g. MEGA) |
| Impact | T1657 Financial Theft — "pay-or-leak"; DLS listing + countdown. T1486 encryption is occasional, not standard |
Access vector & exposed surface
The initial-access vector has not yet been publicly disclosed; the affected organisation and CERT-In are investigating, and details await official confirmation. From open sources, passive scanning surfaced two internet-facing edge exposures consistent with the actor's primary vector: a remote-access VPN of a heavily-exploited family on the affected company's own domain, and a publicly-reachable administration interface on an edge appliance that bridges into the affected environment. Both are externally observable; neither has been established as the entry point, and nothing in the public record indicates which, if either, was used. Pending official disclosure, these stand as triage leads for incident response, not a determined vector. Specific hosts are shared via responsible disclosure rather than published.
Detection & hunting
With no encryptor and no C2, hunt on behaviour and volume, not signatures:
- Egress anomalies — sustained outbound transfer / large archive creation from file servers, DMS, SAP, or engineering repositories; outbound to consumer cloud (MEGA and similar) from server segments.
- Remote-access misuse — VPN/portal logins from new geographies or ASNs, impossible-travel, off-hours interactive logons, service accounts authenticating interactively.
- Session-token / MFA-bypass indicators — reuse of session cookies from new devices; authentications with no accompanying MFA challenge.
- Bulk read patterns — mass document access across a DMS / file-share / SRM in a short window.
- Edge appliance integrity — unexpected config/file changes on VPN/edge devices; log gaps (anti-forensics).
Defensive actions
- Enforce MFA on every remote-access path (VPN, RDP, portals); shorten session lifetimes to blunt cookie theft.
- Patch & monitor internet-facing VPN/edge appliances; treat any pre-patch exposure as assume-breach and rotate credentials + session tokens (patching alone doesn't evict stolen creds).
- Continuous stealer-log / credential monitoring for corporate domains; force resets on exposure.
- Segment & instrument data stores (DMS/SAP/file-shares) for bulk-read and egress alerting.
- Third-party/contractor risk — sensitive data on a contractor's estate inherits the contractor's posture; make MFA, patching, hosting disclosure, and breach-notification contractual.
- Run this recon against yourself — the attacker's external footprinting is free and passive; map your own exposed VPN/portal surface on a schedule.
