What the CDSL Malware Attack Teaches Organizations About VAPT?

Most organizations believe that completing an annual Vulnerability Assessment and Penetration Testing (VAPT) exercise is enough to satisfy cybersecurity requirements. The 2022 malware attack on Central Depository Services Limited (CDSL) tells a very different story. Despite undergoing a VAPT assessment only months before the incident, CDSL experienced a malware attack that disrupted settlement operations across India's securities market.

Following an extensive forensic investigation, the Securities and Exchange Board of India (SEBI) identified multiple security control failures that enabled attackers to compromise the environment and remain undetected. The investigation revealed a recurring theme. The issue was not the absence of cybersecurity investments. The organization had security tools, endpoint protection, and periodic VAPT assessments. The problem was that one system was excluded from critical security controls.

That overlooked system became the attacker's entry point. For organizations planning Vulnerability Assessment and Penetration Testing, the CDSL incident demonstrates an important reality.

 " A VAPT assessment will only be effective when all the critical and non critical systems are included within its scope ”

When One Server Becomes the Weakest Link

Every major cyber incident has a beginning. In the CDSL attack, investigators traced the compromise back to an Azure-hosted Active Directory Federation Services (ADFS) server that had been deployed during the COVID 19 remote working period.

Originally introduced to enable secure remote authentication and single sign-on capabilities, the server gradually became part of the production environment.

Unfortunately, it never became part of the organization's security perimeter.

According to the SEBI investigation, the ADFS server:

• Was internet-facing.
• Was not classified as a critical asset.
• Was excluded from Vulnerability Assessment and Penetration Testing.
• Was not integrated into the Security Information and Event Management (SIEM) platform.
• Was not protected through Privileged Identity Management (PIM).
• It had weak, non-expiring admin credentials. A domain-admin account had an easily guessable password set to "never expire." 
• The RDP port was left open to the internet.

Attackers exploited this single gap to gain access without triggering any meaningful security alerts.

This incident demonstrates why effective Vulnerability Assessment and Penetration Testing (VAPT) should start with comprehensive asset discovery. Security assessments limited to known production systems can overlook unmanaged or forgotten assets that significantly increase an organization's attack surface.

also read: Coinbase Data Breach: Bribery Leads to USD 400 Million Loss

What Happened During the November 2022 CDSL Malware Attack?

On 18 November 2022, shortly after end-of-day processing completed, CDSL detected that several servers and employee workstations had become inaccessible due to a malware attack.

As part of its incident response, the organization isolated compromised systems, segmented affected network areas, and restored critical infrastructure within a newly deployed, clean virtual LAN (VLAN) environment to prevent further spread and support secure recovery.

Although containment prevented wider propagation across market participants, several critical depository services experienced significant disruption. Because of the disruption, settlement transactions originally planned for 18 November were postponed until 20 November. The delay affected normal settlement operations and temporarily disrupted activities across India's securities ecosystem.

The incident demonstrated how a cybersecurity event affecting a single organization can rapidly impact an entire financial market.

How One Overlooked Internet-Facing Server Became the Initial Attack Vector

The SEBI forensic investigation identified asset visibility as one of the primary factors behind the CDSL malware attack. An internet-facing Active Directory Federation Services (ADFS) server was not classified as a critical asset, despite being externally accessible. This single oversight created multiple security gaps that attackers exploited.

Because the server was excluded from the organization's critical asset inventory, it was also left out of the Vulnerability Assessment and Penetration Testing (VAPT) scope. In addition, its logs were not integrated with the SIEM platform, Privileged Identity Management (PIM) controls were not implemented, and security monitoring did not adequately cover the system. As a result, the attackers gained access and operated with minimal visibility before the incident was detected.

This incident demonstrates an important cybersecurity lesson: an organization's attack surface extends to every internet-facing asset. If even one externally accessible system is overlooked during asset discovery or excluded from VAPT, it can become the initial attack vector that puts the entire environment at risk.

Also read: Critical FortiOS Flaw Allows Unauthorized Access and Full Device Takeover

Five Critical Security Gaps Identified by the SEBI Investigation

1. Internet-Facing Infrastructure Outside the VAPT Scope

SEBI's investigation concluded that the ADFS server should have been classified as a critical internet-facing system under updated regulatory guidance.

Because it was excluded, the organization's security assessment never evaluated its attack surface.

External Penetration Testing should always include:

• Internet-facing authentication servers
• VPN gateways
• Remote access infrastructure
• Cloud-hosted virtual machines
• Identity services

One missing asset can invalidate an otherwise successful security assessment.

2. Exposed Remote Desktop Protocol (RDP)

Investigators also found that network vulnerability assessment scanning had not been performed against the affected infrastructure. As a result, an internet accessible Remote Desktop Protocol (RDP) service remained exposed.

The exposed RDP service provided attackers with a pathway into the environment that should have been identified during External Infrastructure VAPT.

3. Weak Privileged Credentials

The forensic investigation identified multiple privileged access weaknesses, including:

• Weak administrative password
• Password configured to never expire
• Long-term privileged access
• Excessive administrative permissions

These weaknesses enabled attackers to maintain persistence after the initial compromise. Modern Penetration Testing should never focus solely on software vulnerabilities. Privilege escalation testing and identity security reviews are equally important.

4. Missing Multi-Factor Authentication

The compromised system lacked two-factor authentication for remote administrative access. Even when attackers obtain credentials, MFA significantly increases the difficulty of successful compromise. Identity protection should always complement Vulnerability Assessment.

5. SIEM Visibility Gaps

One of the most significant findings of the SEBI investigation was that the compromised server was not integrated with the organization's Security Information and Event Management (SIEM) platform. As a result, security logs from the server were not collected or correlated, allowing malicious activity to continue without effective detection. The investigation also noted that alerts generated by existing security tools were not properly acknowledged or investigated, delaying the organization's response to the attack.

This incident highlights the complementary roles of Vulnerability Assessment and Penetration Testing (VAPT) and a Security Operations Center (SOC). While VAPT helps identify and remediate security weaknesses before attackers can exploit them, a SOC continuously monitors systems to detect and respond to active threats. Organizations need both proactive security testing and continuous monitoring to build a resilient cybersecurity posture.

Why the Existing VAPT Failed to Prevent the Attack

One of the most important lessons from the CDSL incident is that the organization had already completed a Vulnerability Assessment and Penetration Testing (VAPT) exercise several months before the malware attack. However, the investigation found that the issue was not how often VAPT was conducted, but what it covered. The internet-facing ADFS server, the attackers' entry point, was excluded from the assessment scope, leaving a critical gap in the organization's security posture.

This highlights an important reality for security leaders: a clean VAPT report does not automatically mean an organization is secure. It only reflects the systems, applications, and infrastructure that were actually tested. If critical internet-facing assets are omitted, significant vulnerabilities can remain undiscovered until attackers exploit them.

The Business Impact: How the CDSL Cyberattack Disrupted Market Operations

The technical compromise quickly evolved into an operational crisis.

According to the SEBI order:

• Settlement processes were disrupted for approximately 46 hours.
• Inter-depository transfers remained unavailable for more than 54 hours.
• Corporate actions, pledge processing, and off-market transfers were delayed.
• Critical market settlement activities scheduled for 18 November were completed only on 20 November through coordinated recovery efforts.

The incident illustrates how cybersecurity failures can extend far beyond IT systems and directly affect business continuity, regulatory compliance, and customer confidence.

Five Cybersecurity Lessons Every Organization Should Learn from the CDSL Attack

No	Cybersecurity Lesson	Key Takeaway
1	Maintain a Complete Inventory of Internet-Facing Assets	Identify, classify, and continuously monitor every internet-facing server, application, and service to eliminate blind spots.
2	Include Every Critical System Within the VAPT Scope	Ensure all critical infrastructure, identity services, and externally accessible assets are included in every VAPT assessment.
3	Perform Both External and Internal Penetration Testing	Combine External Penetration Testing to identify attack vectors with Internal Penetration Testing to uncover privilege escalation and lateral movement risks.
4	Validate Remediation After Every Assessment	Confirm that identified vulnerabilities have been successfully remediated and can no longer be exploited.
5	Combine VAPT with Continuous Security Monitoring	Pair Vulnerability Assessment and Penetration Testing (VAPT) with continuous Security Operations Center (SOC) monitoring to detect and respond to threats in real time.

How SecuCenter Helps Organizations Strengthen Their Security Posture

At SecuCenter, we approach Vulnerability Assessment and Penetration Testing as a continuous risk reduction program rather than a compliance exercise.

Our VAPT services include:

• Vulnerability Assessment
• External Penetration Testing
• Internal Penetration Testing
• Network VAPT
• Web Application Penetration Testing
• API Security Testing
• Cloud Security Assessment
• Active Directory Security Assessment
• Infrastructure Security Assessment
• Wireless Security Testing
• Configuration Review
• Remediation Validation
• Executive Reporting
• Compliance Ready Reporting
• Managed VAPT Services

Our assessments are designed to identify overlooked assets, validate real-world attack paths, and provide actionable remediation guidance before threat actors discover the same weaknesses.

Also read: A Critical Vulnerability Rating of 10/10 Has Been Confirmed By Microsoft

The Biggest Cybersecurity Risk Is Often the System You Forgot to Test

The CDSL malware attack is more than a story about malware. It is a reminder that cybersecurity failures often begin with overlooked assets, incomplete visibility, and assumptions about what is or is not critical. One internet-facing authentication server, excluded from Vulnerability Assessment and Penetration Testing, became the initial foothold that enabled attackers to disrupt one of India's most critical financial infrastructures.

Organizations should not treat VAPT as a once-a-year compliance requirement. Effective security requires continuous asset discovery, comprehensive testing of external and internal attack surfaces, timely remediation, and ongoing monitoring.

The most valuable lesson from the CDSL incident is simple:

Attackers only need one system that defenders forgot to test.