NIA Busts Cyber Terror Network Behind 54 DDoS Attacks on Govt Websites

The National Investigation Agency has launched a coordinated multi-state crackdown on a cyber terror network accused of orchestrating sophisticated attacks against Indian government digital infrastructure. The NIA conducted searches across five locations in Maharashtra, Gujarat, Telangana, Bihar and Delhi yesterday as part of the Cyber Terrorism Gujarat Case, the PIB stated.

According to the NIA, the accused carried out Distributed Denial-of-Service (DDoS) attacks targeting 54 websites of Central Government entities. The attacks focused on critical computer resources and Critical Information Infrastructure during the period designated as Operation Sindoor, with the case registered in Gujarat last year.

The DDoS assault was designed to undermine India’s national sovereignty, security and unity while creating public panic, the NIA said. During the multi-state searches, investigators seized digital devices and documents containing evidence of hacking activities and related cyber offences.

This case highlights the evolving threat landscape India faces in cyberspace. DDoS attacks, which flood targeted servers with traffic to render them inaccessible, remain a favoured tool of state-sponsored and non-state adversaries seeking to disrupt government services and critical infrastructure without leaving conventional forensic evidence.

India’s critical information infrastructure, including power grids, financial networks, communications systems and defence-related digital assets, has faced sustained probing by hostile intelligence agencies and proxy networks over the past decade. The targeting of 54 government portals simultaneously suggests a level of coordination and technical sophistication that points to either state-level involvement or a well-resourced non-state actor with access to commercial DDoS-for-hire services.

The NIA’s investigation spans five states, indicating a distributed network of perpetrators likely communicating through encrypted channels and using technical methods to mask their locations. The seizure of digital devices and documents in the coordinated dawn raids is critical to establishing the command structure, funding sources and possible foreign connections of the network.

Operation Sindoor, the temporal marker cited by the NIA, suggests these attacks occurred during a specific period of heightened tension or strategic significance. The coordinated nature of this investigation, involving simultaneous raids and centralised NIA leadership, reflects the government’s treating cyber attacks on critical infrastructure as acts of terrorism rather than conventional cybercrime.

India has progressively hardened its cyber defences over the past five years through the National Critical Information Infrastructure Protection Centre and sectoral nodal agencies. However, the persistence of attacks at this scale underscores the asymmetric challenge posed by adversaries operating from jurisdiction beyond Indian reach.