Background and Timeline
In December 2025, the Madhya Pradesh Computer Emergency Response Team (MP-CERT) successfully foiled a cyberattack targeting state government websites. The attack, attributed to IcePeony—a known advanced persistent threat (APT) group associated with cyber espionage—was detected as an SEO poisoning redirect campaign, aiming to compromise government infrastructure.
Modus Operandi
The attack involved sophisticated malware masquerading as legitimate IIS components, employing deceptive DLL names, heavy packing, runtime decryption, and advanced defense evasion techniques. The malware was designed to evade standard antivirus tools and gain persistent access to government systems. The SEO poisoning strategy sought to redirect web traffic to malicious sites, potentially enabling further exploitation or data theft.
Victims and Impact
No data breach or service disruption occurred, thanks to prompt detection and response by MP-CERT and the Madhya Pradesh State Electronics Development Corporation (MPSeDC). All digital services continued to operate securely, and intensive monitoring and audits were conducted to validate containment and system integrity.
Investigation and Agencies Involved
MP-CERT led the response, supported by MPSeDC. The incident was reported to CERT-In (Government of India), and a comprehensive audit of government IT systems was conducted. Additional security controls, source code analysis, and regular audits were implemented to strengthen defenses against future threats. Antivirus systems were updated with malware signatures shared by MP-CERT.
Arrests and Suspects
No arrests have been reported, as the attack is attributed to a state-sponsored APT group rather than individual hackers. The incident highlights the persistent threat posed by cyber-espionage actors targeting government infrastructure across India.
Broader Implications and Trends
The foiled attack reflects the increasing sophistication of cyber threats facing Indian government entities. The use of advanced malware, SEO poisoning, and defense evasion tactics underscores the need for continuous monitoring, rapid incident response, and proactive security measures. The case also highlights the importance of inter-state and national coordination in defending against APT campaigns targeting critical infrastructure.