Inside the Chinese Cyberattack That Almost Blacked Out a Billion Indians

In a chilling cyber-espionage campaign, state-linked Chinese hackers have been probing India’s power grid — so closely, experts say, they were almost in a position to knock out electricity for a billion people.

That’s not speculation. According to a report by Recorded Future, a U.S.-based threat-intelligence firm, Chinese cyber teams have targeted at least seven “load dispatch” centers in northern India. These centers are critical for real-time operations that control electricity flow.

The attacks were not random. They were highly focused, and likely designed for “information gathering surrounding critical infrastructure,” rather than simple theft. Recorded Future says this could be part of “pre-positioning for future activity.” In other words: this could be more than spying — it could be a dry run.

The hackers reportedly used malware called ShadowPad, a tool that has been linked to Chinese state agencies, including the Ministry of State Security and even the People’s Liberation Army. What’s striking is how they carried out the attacks: not just through corporate servers, but via compromised Internet-of-Things devices — think CCTV cameras, DVRs — many based in South Korea and Taiwan. It’s a reminder that even your home security camera can be a weapon in a state-sponsored cyberwar.

Indian counter-cyber agencies didn’t just sit back. CERT-In (Indian Computer Emergency Response Team) had warned grid controllers about Chinese-backed cyberattacks as early as November. They flagged critical IP addresses and domains, and firewalls were strengthened in response. According to insiders, antivirus scans and additional security measures were rolled out across control centers.

Still, there were gaps. A recent audit showed that more than 270 substations across India lack “next-generation” firewalls — systems that detect and prevent intrusions. Installing these firewalls would cost the Power Grid Corporation an estimated ₹119 crore, and officials have said that fitting this into the current operations budget is “difficult.” That’s a big price for digital safety, but in cyberspace, the cost of not paying can be far greater.

India’s government says, so far, there has been “no impact on any operation” of its power grid from these malware attacks. According to the Ministry of Power, there’s “no data breach / data loss” detected, and the critical control operations remain intact. Still, experts caution that not all cyber threats lead to immediate, visible damage — sometimes the worst attacks are the ones that prepare the battlefield.

The suspected Chinese hackers have repeatedly denied the allegations. Beijing’s foreign ministry spokesperson has said it is “highly irresponsible” to accuse China when “there is no sufficient evidence.” That denial has become almost a ritual in these cases, but it does little to quiet the tension.

The situation raises serious questions about India’s cyber-defense readiness. With hundreds of thousands of attacks reportedly foiled in one tight period, India’s cyber agencies have their hands full. Meanwhile, according to reports, many grid control centers remain vulnerable because of missing or weak firewalls.

There are also broader geopolitical implications. The targeted load dispatch centers are located near Ladakh — a region with long-standing tension between India and China.

According to Recorded Future, the hackers’ focus on this region suggests a strategic motive, not just espionage. If the hackers were merely after telecom secrets or trade data, they might have cast a wider net. Instead, they zeroed in on centers that, in a worst-case scenario, could be used to inflict blackout-level damage.

Some argue that this may be part of a broader “cyber signalling” campaign — a way for China to warn India without going to war. In that sense, the cyber probe is not just technical, but psychological.

In response, India created a dedicated cyber response team for its power sector — the CSIRT-Power, under the Central Electricity Authority. The idea is to better monitor cyber threats, coordinate rapid responses, and conduct forensic analysis. But setting up the team is only half the job: it needs real muscle, resources, and constant vigilance.

To be fair, India’s been on alert. According to reports, more than 200,000 cyberattacks on its power grid were allegedly foiled over just a few days in May. That’s not a small number — but it’s also a reminder of how exposed critical infrastructure remains.

No one is claiming that India’s lights went out thanks to this cyber campaign — not yet, at least. But the fact that a stealthy, state-linked group came this close is getting national security experts to lose sleep. And rightly so.

Featured image via Youtube screengrab