RedEcho and the China-Nexus Targeting of India's Power Grid
Not every threat to India is fraud or Pakistan-nexus espionage. China-linked intrusion sets have repeatedly targeted India's power sector and critical infrastructure using ShadowPad and compromised internet-facing devices. A profile of RedEcho, TAG-38 and what it means for OT defenders.
On this page
The threats most Indians feel day to day are fraud and smishing. The threats that keep national-security planners up at night are different: China-nexus intrusion sets targeting India's power grid and critical infrastructure. Grouped under names like RedEcho and TAG-38, this activity is a reminder that the Indian threat landscape runs from a fake challan APK all the way up to the systems that keep the lights on.
At a glance
- Aliases / clusters: RedEcho, TAG-38 (Recorded Future naming); overlaps with broader China-nexus activity
- Suspected origin: China-nexus
- Primary targets: Indian electricity sector — load-dispatch centres, grid assets — and other critical infrastructure
- Signature malware: ShadowPad, PlugX
- Notable access method: compromised internet-facing devices (including DVR/IoT) used for command-and-control
- MITRE ATT&CK (tooling): ShadowPad / S0596
The campaigns
Public reporting from Recorded Future laid out two waves worth knowing:
- RedEcho (disclosed Feb 2021): targeting of Indian power-sector organisations, including regional load-dispatch centres — the facilities that balance electricity supply and demand across the grid. The intrusions centred on the ShadowPad backdoor and shared infrastructure.
- TAG-38 (disclosed April 2022): continued targeting of grid infrastructure in Ladakh, notably using compromised internet-facing DVR/IoT devices as part of the command-and-control path — a technique that hides malicious traffic inside connections to innocuous-looking hardware.
The strategic context is hard to miss: this activity has repeatedly coincided with periods of India-China border tension, consistent with intelligence collection and pre-positioning against critical infrastructure.
Why this is a different kind of threat
Fraud costs individuals money. Espionage against the grid is about access and leverage:
- Pre-positioning. Quiet, persistent access to operational networks is valuable long before it's ever used — it's an option held in reserve.
- ShadowPad is a serious implant. A modular backdoor shared among several China-nexus groups, it's built for stealth and long-dwell espionage, not smash-and-grab.
- The entry points are the unglamorous ones. Internet-exposed appliances and IoT/DVR devices — the same class of neglected edge hardware that shows up in intrusion after intrusion — become C2 relays and footholds.
What defenders should do
For anyone running critical infrastructure or OT in India:
- Get edge and IoT devices off the open internet, patch or replace them, and change default credentials. DVRs, cameras and appliances are being used as infrastructure by these actors.
- Segment IT from OT, and treat any path between them as high-risk. Monitor it specifically.
- Deploy OT-aware monitoring that understands ICS protocols and can flag a ShadowPad-style implant or unexpected connections into control networks.
- Hunt for ShadowPad/PlugX indicators and long-dwell beaconing, and watch for connections to or from IoT/DVR devices that shouldn't be talking to the internet.
The takeaway
RedEcho and TAG-38 are the top end of the Indian threat landscape: patient, state-aligned, and aimed at the grid itself. It's the reason an India threat tracker can't just be about fraud and phishing — the same country that gets flooded with fake-APK scams also has its critical infrastructure in a nation-state's sights. All of it is tracked, in context, in the India Threat Tracker.
This article reflects public information as of 25 September 2026, and summarises public reporting on this activity.
