Malicious Go Crypto Module Deploys Rekoobe Backdoor: Threat Analysis, Legal Remedies under IT Act & BNS, and Cyber Reporting in Mumbai

Modern enterprise applications rely extensively on open-source package registries to accelerate development cycles. However, open-source repositories have increasingly become the primary staging ground for sophisticated supply-chain attacks. A recent campaign identified a malicious Go (Golang) module masquerading as an authentic cryptographic library. Instead of merely providing mathematical or encryption utilities, the module silently intercepts user credentials, exfiltrates sensitive tokens, and deploys the Rekoobe backdoor onto the host operating system.

For technology companies, financial service providers, and startups across Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR), such vulnerabilities are not merely technical bugs. They represent systemic operational disruptions that trigger strict liabilities under Indian cyber law and data protection frameworks.

Understanding the Threat: The Go Module Vector and the Rekoobe Backdoor

Software supply-chain attacks exploit developer trust. Attackers leverage typosquatting, brand impersonation, or compromised maintainer accounts to publish packages that mimic trusted cryptographic libraries in the Go ecosystem (such as variants mimicking golang.org/x/crypto).

1. Infiltration and Credential Harvesting

Once a developer imports the rogue Go package into an application build, the module executes an initialization routine (init() function in Go). This routine operates asynchronously to avoid detection during compilation. It inspects local system memory, environment variables, configuration files, and CI/CD pipelines to harvest:

API secrets and access keys;
Database authentication credentials; and
Cryptographic private keys and passwords.

2. Dropping the Rekoobe Backdoor

Beyond passive exfiltration, the malicious package downloads an obfuscated payload containing the Rekoobe backdoor. Rekoobe is a lightweight, cross-architecture Trojan (frequently compiled for x86, x64, and ARM architectures) adapted from open-source Unix code. Once executed, it:

Establishes an encrypted, covert command-and-control (C2) channel;
Evades basic perimeter firewall alerts by masquerading as routine system processes; and
Grants threat actors interactive shell access, enabling lateral movement, privilege escalation, and arbitrary execution of further secondary payloads.

Indian Legal Dimensions: IT Act, 2000 and Bharatiya Nyaya Sanhita, 2023

When a developer workstation, cloud container, or production server in India is compromised by a malicious dependency, several civil and criminal statutes are engaged.

1. Information Technology Act, 2000

Section 43 (Damage to Computer, Computer System, etc.): Downloading, introducing, or causing to be introduced any computer contaminant or computer virus into any computer system without permission of the owner attracts civil liability and compensation.
Section 66 (Computer-Related Offences): Dishonestly or fraudulently committing any act referred to in Section 43 constitutes a cognizable offence punishable with imprisonment up to three years or fine up to five lakh rupees.
Section 66C (Identity Theft): The harvesting and exfiltration of passwords, digital signatures, or unique identification features through the Go module directly attracts Section 66C.
Section 66D (Cheating by Personation using Computer Resource): Using deceptive packages to impersonate authentic crypto libraries constitutes cheating by personation.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the replacement of the Indian Penal Code, offences related to cyber fraud, data theft, and supply-chain compromise intersect with the Bharatiya Nyaya Sanhita, 2023 (BNS):

Section 316 (Criminal Breach of Trust): Where rogue internal developers or third-party contractors deliberately introduce unauthorized backdoors into proprietary codebases.
Section 318 (Cheating): The fraudulent induction of a victim enterprise to execute malicious code under the guise of an authentic utility.
Section 61 (Criminal Conspiracy): Coordinated campaigns targeting corporate infrastructure using multi-stage payloads.

3. Digital Evidence and the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Securing forensic artifacts—such as server logs, network pcap captures, Git commit histories, and memory dumps—is vital. Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA) (which replaces Section 65B of the Indian Evidence Act), electronic records must be accompanied by an electronic certificate verifying authenticity, system integrity, and chain of custody to be admissible before Indian courts.

Regulatory Compliance: The CERT-In 6-Hour Reporting Mandate

Under directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, all corporate entities, service providers, intermediaries, and data centers are legally obligated to report specified cyber security incidents within six (6) hours of noticing or being brought to notice of the incident.

Incidents triggered by this attack that fall under mandatory reporting include:

Unauthorized access of IT systems/data;
Deployment of malicious code, Trojans, or backdoors (such as Rekoobe);
Attacks on critical infrastructure or supply chains; and
Data breaches involving compromised enterprise or customer credentials.

Failure to report incidents to CERT-In is an offence under Section 70B(7) of the IT Act, exposing company directors and designated officers to statutory fines and penal proceedings.

Practical Incident Response & Reporting in Mumbai, Thane, and Mira Road

For enterprises headquartered or operating in Mumbai, Thane, and the Mira-Bhayandar belt, responding to an active backdoor compromise requires immediate technical containment aligned with standard criminal procedure under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS).

Step 1: Containment and Forensic Preservation

Do not instantly wipe, reboot, or destroy compromised instances. Volatile memory (RAM) contains the Rekoobe execution state and active C2 socket connections.
Isolate affected subnets, revoke leaked API credentials, and snapshot virtual machines.
Generate cryptographic hash values (SHA-256) of forensic disk images to ensure evidentiary integrity under Section 63 of BSA.

Step 2: Lodging an Official Cyber Complaint

Victim organizations should escalate through formal legal and police channels:

National Cyber Crime Reporting Portal: Lodge an initial formal report on the central portal (cybercrime.gov.in).
Mumbai Cyber Crime Police Stations: For Mumbai jurisdiction, high-value corporate intrusions and cyber intrusions are investigated by specialized units, including:
- Cyber Police Station (BKC): Specialized in sophisticated cyber intrusions, corporate hacking, and large-scale data breaches;
- Regional Cyber Police Stations in South, Central, West, East, and North Mumbai.
Thane Cyber Cell: Entities situated in Thane should approach the Thane Cyber Crime Police Station located near the Office of the Commissioner of Police, Thane.
Mira-Bhayandar, Vasai-Virar (MBVV) Cyber Crime Police Station: Organizations operating in Mira Road, Bhayandar, or Vasai can report directly to the MBVV Cyber Police Station at Mira Road.

Step 3: Initiating Adjudication for Civil Damages

Beyond criminal FIRs, victim businesses can file an application for compensation under Section 46 of the IT Act before the Adjudicating Officer, Information Technology Department, Government of Maharashtra (located at Mantralaya, Mumbai). This forum adjudicates civil damages up to five crore rupees per contravention against entities responsible for unauthorized computer access or negligence under Section 43/43A.

Frequently Asked Questions (FAQs)

1. Can an enterprise be held legally liable if its software passes a malicious Go module to third-party clients?

Yes. Under Section 43A of the IT Act (and emerging obligations under the Digital Personal Data Protection Act, 2023), companies that fail to maintain reasonable security practices—such as software composition analysis (SCA), code auditing, and dependency pinning—may be held liable for civil damages to clients whose data or networks are compromised as a downstream result.

2. Is software supply-chain poisoning considered an offence under the new Bharatiya Nyaya Sanhita, 2023?

While cyber-specific hacking is codified under Section 66 of the IT Act, 2000, supply-chain poisoning involves elements of cheating (Section 318 BNS), criminal conspiracy (Section 61 BNS), and potentially mischief or extortion depending on the ultimate payload deployed.

3. What technical logs are mandatory to retain for compliance in India?

Per CERT-In directions, all organizations, intermediaries, and service providers must securely maintain system logs of all their ICT systems for a rolling duration of 180 days within Indian jurisdiction, and provide them to authorities upon legal notice.

4. What should a company do if an internal employee deliberately pulled the malicious module?

If an internal developer or contractor intentionally introduces malicious packages, the company can initiate criminal proceedings for Criminal Breach of Trust under Section 316 of the BNS, unauthorized access under Section 43/66 of the IT Act, and simultaneously initiate summary disciplinary termination under relevant employment contracts and enterprise policies.

Consult APS Law on Cyber Incidents and IT Compliance

Software supply-chain attacks require immediate legal navigation spanning CERT-In regulatory compliance, evidence preservation, and police representation. APS Law provides strategic counsel to startups, technology enterprises, and corporate clients across Mumbai, Thane, and Mira Road in navigating IT Act disputes, cyber fraud reporting, and digital forensics litigation.

If your organization has detected unauthorized intrusions, supply-chain vulnerabilities, or backdoors, reach out to APS Law to schedule a consultation with our cyber law practice group.