The Indian Railways has issued a cyber-security advisory to all zonal railways and other key railway organisations following a script-based cyber incident reported in Central Railway on August 11 this year. The authorities warn that messaging applications, particularly WhatsApp Web, can be exploited to deliver malicious files and potentially compromise computers connected to railway networks.
As per root-cause analysis cited by the authorities, the incident happened when a user received a malicious “E-statement.vbs” file in a WhatsApp group. The file was downloaded onto the user’s computer through the WhatsApp Web application and was subsequently opened by double-clicking it.
“The incident has prompted the Railway Board to direct its units to strengthen endpoint protection and user awareness against malware campaigns exploiting messaging platforms. It is also consistent with a CERT-In warning about a wider campaign in which malicious VBScript files are distributed through WhatsApp, including through compromised accounts to make the messages appear trustworthy,” said the railway official.
Railway units have been asked to ensure that all endpoints connected to railway networks are covered by cyber-security solutions, including ITSM and Endpoint Detection and Response (EDR). The employees have been advised to avoid opening files with extensions such as .vbs, .vbe, .exe, .bat, .cmd, .js and .ps1, unless their authenticity and necessity have been independently verified.
Employees have been told to exercise caution while opening unexpected attachments, even when they appear to come from known contacts. They should verify the identity of the sender before opening suspicious files or clicking links, and keep operating systems, browsers and messaging applications updated.
They have been asked to enable two-factor authentication (2FA) or two-step verification on WhatsApp and other messaging applications. They have been advised to periodically review devices linked to messaging accounts and log out unfamiliar devices. They have been told to avoid downloading software distributed through messaging platforms. The Railways has asked its employees that they should never share passwords, OTPs, banking credentials or sensitive information through messaging applications.
According to Indian Computer Emergency Response Team (ICERT) of Ministry of Electronics and Information Technology Government of India, a large-scale malware distribution campaign is targeting users of WhatsApp Desktop and WhatsApp Web, with attackers using compromised WhatsApp accounts to spread malicious Visual Basic Script (VBScript) files, according to a cybersecurity alert.
Cybersecurity researchers have observed that some of the VBScript samples contain extensive comments designed to imitate legitimate Microsoft Windows or update-related components. This can make the malicious files appear more credible and potentially reduce suspicion among users.
