Russian Hackers Breach NGOs via Evilginx and Microsoft Entra Phishing: Threat Breakdown and Legal Remedies in India

Introduction: The Surge in Sophisticated Credential Theft

Recent global intelligence reports reveal that state-sponsored cyber adversaries—specifically Russian espionage groups such as APT29 (Midnight Blizzard / Nobelium) and associated threat actors—have compromised over twenty non-governmental organisations (NGOs), civil society groups, and policy think tanks. The primary attack vector relies on an Adversary-in-the-Middle (AiTM) phishing framework known as Evilginx, weaponised through deceptive spoofing of Microsoft Entra ID (formerly Azure Active Directory) login workflows.

While this campaign has targeted international organisations, the underlying methodology poses an urgent threat to Indian entities. Non-profits, policy institutes, multinational corporations, and law firms across major commercial hubs like Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR) increasingly rely on cloud-hosted identity architectures such as Microsoft 365 and Entra ID.

Understanding how this attack neutralises traditional security measures, along with the relevant recourse under Indian cyber and criminal statutes, is critical for organisations seeking to safeguard digital assets and maintain regulatory compliance.

Decoding the Threat: How Evilginx Defeats MFA

For years, standard cybersecurity hygiene emphasised Multi-Factor Authentication (MFA) as the gold standard of account protection. However, modern phishing frameworks such as Evilginx have altered this balance.

The Mechanics of Adversary-in-the-Middle (AiTM) Phishing

Lure and Proxy Setup: Attackers distribute targeted spear-phishing emails containing links to an external domain controlled by them. This domain acts as an invisible reverse proxy between the victim and the legitimate Microsoft Entra ID authentication server.
Real-Time Credential Harvesting: When the victim enters their username and password on the phishing portal, the Evilginx proxy forwards those credentials in real time to the genuine Microsoft Entra login page.
MFA Challenge Interception: Microsoft prompts the user for an MFA response (such as a time-based one-time password [TOTP] or a push notification). The Evilginx proxy mirrors this prompt to the victim. Once the victim approves the authentication on their device, Microsoft generates an authenticated session token.
Session Cookie Theft: The proxy server intercepts and stores the session token (cookie) before passing it along to the user's browser. With this token, the attacker can hijack the authenticated session without ever needing the victim's device or ongoing credentials, effectively bypassing standard MFA.

Once inside the Microsoft 365 or Entra ID tenant, threat actors establish persistence, exfiltrate sensitive donor or litigation data, and manipulate mailbox forwarding rules to conduct surveillance undetected.

The Indian Legal Framework Governing Credential Harvesting

In India, cyber attacks orchestrated through phishing and session hijacking attract severe liabilities under both specialised cyber legislation and penal provisions.

1. The Information Technology Act, 2000 (IT Act)

Section 43 (Damage to Computer Systems & Data Theft): Imposes civil liability and compensation for unauthorised access, extraction, or copying of digital assets from a computer system or cloud tenant.
Section 66 (Hacking): Criminalises fraudulent or dishonest actions causing computer system disruption or damage, punishable by imprisonment for up to three years or a fine, or both.
Section 66C (Identity Theft): Directly applies to phishing and cookie theft. Anyone who fraudulently uses another individual’s digital signature, password, or unique identification feature faces up to three years of imprisonment and monetary fines.
Section 66D (Cheating by Personation): Punishes individuals who cheat using a computer resource or communication device (e.g., hosting fake Microsoft Entra ID interfaces) with up to three years of imprisonment.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

With the replacement of the Indian Penal Code (IPC), corporate and non-profit victims must register complaints under the Bharatiya Nyaya Sanhita, 2023 (BNS):

Section 318 (Cheating): Replaces Section 420 of the IPC, criminalising deception designed to induce an entity to surrender credentials or session cookies.
Section 319 (Cheating by Personation): Replaces Section 416 of the IPC, penalising actors masquerading as legitimate authentication platforms such as Microsoft Entra.
Section 336 and Section 338 (Forgery and Forged Documents): Addresses the digital creation and dissemination of fake login pages and domain signatures aimed at deceit.

3. Preserving Digital Evidence under Bharatiya Sakshya Adhiniyam, 2023 (BSA)

When identifying a security incident, organisations must ensure forensic data is captured in compliance with the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which governs the admissibility of electronic evidence (replacing Section 65B of the Indian Evidence Act). Forensic audits must preserve server logs, token timestamps, IP connection histories, and phishing headers under certified, tamper-evident protocols to withstand judicial scrutiny in Indian courts.

Mandatory Regulatory Obligations in India

Victims of advanced phishing attacks must observe strict compliance protocols to avoid statutory sanctions:

CERT-In Cyber Incident Reporting Directive: Under the directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the IT Act, covered entities are legally required to report cybersecurity incidents—including unauthorised access to identity servers, identity theft, and credential theft—within six hours of noticing or being notified of the incident.
Digital Personal Data Protection Act, 2023 (DPDPA): If an Entra ID breach compromises the personal data of Indian citizens, employees, or donors, the organisation (acting as a Data Fiduciary) must promptly notify both the Data Protection Board of India and the affected data principals.

Step-by-Step Incident Reporting for Victims in Mumbai, Thane, and Mira Road

If your organisation experiences an Evilginx or cloud identity breach, prompt administrative and legal intervention is essential.

Step 1: Administrative and Technical Containment

Immediately invalidate all active user sessions inside the Microsoft Entra admin centre to neutralise intercepted session tokens.
Reset credentials and review Entra ID audit logs for unauthorised enterprise application registrations or modified conditional access rules.
Preserve full unified audit logs (UAL) and Azure sign-in logs for evidentiary use.

Step 2: Registering a Cyber Crime Complaint

File an incident report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the national cyber fraud helpline at 1930.
In Mumbai, submit a formal complaint with the Mumbai Police Cyber Cell:
- BKC Cyber Crime Police Station (handles high-value enterprise cases and complex hacking incidents across Mumbai).
- Local Cyber Units at the South, Central, Western, Eastern, and North Regional police headquarters.
For organisations based in Thane or Mira Road, lodge your complaint with the Thane City Cyber Crime Police Station or the Mira-Bhayandar, Vasai-Virar (MBVV) Cyber Crime Cell.

Step 3: Formal Police Complaint Preparation under BNSS

Ensure your legal counsel drafts the formal complaint under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), clearly highlighting electronic chains of custody, IP originations, compromised session IDs, and forensic reports compliant with the BSA, 2023.

Preventive Measures Against AiTM Phishing

To prevent Evilginx attacks, organisations must adopt phishing-resistant authentication models:

Deploy FIDO2 / WebAuthn Hardware Keys: Hardware-bound tokens (e.g., YubiKeys) validate the domain origin cryptographically, preventing user credentials or tokens from being passed to an intermediate proxy domain.
Enforce Conditional Access Policies: In Microsoft Entra ID, mandate access only from compliant, Intune-managed corporate devices, limiting access even if an attacker acquires an active session token.
Enable Continuous Access Evaluation (CAE): This feature revokes access tokens almost instantaneously when anomalous IP movement or device state changes are detected.

Frequently Asked Questions (FAQs)

1. Does standard Multi-Factor Authentication (SMS/App OTP) protect against Evilginx attacks?

No. Evilginx operates as an active intermediary (reverse proxy). When you enter your password and approve an OTP or push notification, the Evilginx server forwards those details to the legitimate Microsoft server in real time, intercepts the resulting authentication session cookie, and allows the attacker full access without needing future OTPs.

2. What is our legal exposure under Indian law if donor or client data is leaked in a cyber incident?

Under Section 43A of the IT Act (and corresponding provisions of the DPDPA, 2023), organisations that fail to implement reasonable security practices to protect sensitive personal data can be held liable for civil damages, as well as statutory financial penalties imposed by regulatory bodies.

3. What is the mandatory time limit for reporting an Entra ID breach to CERT-In?

Under the CERT-In Directions of April 2022, organisations in India must report identified cybersecurity incidents—including compromised systems, phishing attacks, and unauthorised access to digital assets—within six hours of confirmation.

4. Which police station has jurisdiction over a cyber incident in Thane or Mira Road?

Incidents originating in Thane city fall under the Thane Commissionerate's Cyber Police Station. If your entity operates in Mira Road or Bhayandar, jurisdiction lies with the MBVV (Mira-Bhayandar, Vasai-Virar) Cyber Crime Cell, alongside initial registration on the national cyber crime portal.

How APS Law Can Assist

Navigating an active cyber incident demands immediate technical coordination, regulatory reporting, and legal enforcement. APS Law advises corporates, startups, institutions, and non-profits across Mumbai, Thane, and Mira Road on cyber law compliance, data breach management, CERT-In disclosures, and criminal litigation under the IT Act, BNS, and BSA.

To schedule a consultation with our cyber law practice group, contact APS Law today.