Surface Intelligence

·CERT-In issues emergency advisory on critical RCE in 6 major Indian banking apps

·LockBit 3.0 claims attack on Tata Technologies, threatens 23 GB R&D data leak by Nov 25

·@IndiaLeaks: NEW DUMP — 410K Indian fintech credentials. Paytm · PhonePe · Groww. Verified via checker.

·Thread: Coordinated spear-phishing hits 12 Indian PSU banks simultaneously — IOC list inside

·[LIVE DEMO] OTP bypass in Indian banking app — full walkthrough, no root, Android 13

·Reverse engineering IndiaStealer v2.3 — C2 protocol, persistence, AV evasion [Full analysis]

·r/netsec: IndiaStealer v2.3 — new WMI persistence, kills 14 AV processes on launch

·r/india: My Paytm account drained overnight — full phishing message + IOCs [3.4K upvotes]

·[CRITICAL] Active AWS keys committed to public ISRO-affiliated repo — rotated after disclosure

·india-osint-toolkit: 47 scripts for Indian govt APIs, phone lookups, MCA registry — 3.8K stars

·Responsible disclosure: Critical RCE in IRCTC booking engine — 90-day timeline, patched day 74

·Post-incident: SBI misconfigured S3 bucket exposed 1.2M customer records for 11 days

·Indian .gov.in domain hijacked, briefly served Lumma Stealer to ministry contractors

·CERT-In investigates supply chain attack on CMS vendor serving 200+ Indian ministry portals

·AnonIndia channel: 'Operation Gandhi' — DDoS on 15 govt portals scheduled Nov 25, tool links shared

·IndiaStealer bot: 2.1M Indian healthcare records, Aadhaar-linked, sample on request — $4,500 XMR

·Pastebin [ACTIVE]: 4,200 Indian govt employee credentials — ministry, role, hashed password, email

·Ghostbin: DRDO site-to-site VPN config — PSK, endpoint IPs, routing tables [classified marking visible]

·Hack Forums [CRITICAL]: Initial access sale — Indian nationalized bank, domain admin, 8,400 endpoints, $45K

·BHF: Zero-day RCE for Indian govt portal CMS — $12K, unpatched in 340+ deployments

·Page 'India Data Exposed' (52K followers): daily posts of Aadhaar-linked phone numbers

·Group 'Indian Hacking Network' (14K members): tutorial posts targeting UIDAI infrastructure

·Account @drdo_exposed: DRDO employee ID card scans — suspended after 38 posts

·Reel: Unauthorized drone footage of Indian naval facility — 3.1M views before removal