Cybersecurity | Swing Trader | Tightness & Momentum Trader | VCP | Learning never ends | Twitter - My Trading Journal

Mumbai, India
Joined March 2021
🚨 A serious internet-security incident just came to light, and it involves an Indian company, eMudhra Ltd. Secret keys belonging to eMudhra, a company whose job is to help prove websites are genuine, ended up in the wrong hands. Google, Mozilla (Firefox), Apple and Microsoft have all had to step in. In this thread I'll explain what happened in plain language, why it matters, and what you need to do. 🧵
‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised. Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes. Full details - thehackernews.com/2026/10/ei…
18
192
7
1,116
236,066
🚨 Another one, and this time it's India's defence sector. A threat actor called "Evil Markhors" claims to have leaked data from Bharat Electronics Limited (BEL), India's state-owned defence electronics company. Claimed: Aadhaar/PAN KYC records, 50K+ recruitment records, retiree data, 19 working credential sets, and 4 signing certificates with private keys. ⚠️ Unverified, and BEL hasn't responded yet. If you work at BEL, have applied there, hold its shares, or are a BEL retiree: 
❌ Don't trust calls or emails asking you to "verify" KYC or pension details
❌ Never share OTPs
✅ Watch for unusual activity on your PAN and bank accounts October was supposed to be Cybersecurity Awareness Month. It's turning into a live case study.🙃 #CyberSecurityAwarenessMonth #BEL #DataBreach #BharatElectronics
🇮🇳 🚨 INDIA: EVIL MARKHORS CLAIMS BREACH OF BHARAT ELECTRONICS (BEL), DEFENSE FIRM'S PERSONNEL AND SHAREHOLDER KYC DATA ALLEGEDLY LEAKED The hacktivist group Evil Markhors claims it breached Bharat Electronics Limited (BEL), India's state-owned defense electronics manufacturer, and leaked about 1 GB of internal data (around 1,069 files). The actor claims: * A roster of roughly 18,000 to 19,500 retirees and spouses * 23,553 shareholder KYC records, including PAN, Aadhaar and dates of birth * More than 50,000 rows of recruitment candidate data * Around 6,000 health-benefit portal accounts, working login credentials and organizational digital-signature private keys ⚠️ Analyst Note: If real, the Aadhaar and PAN data puts shareholders and staff at high risk of identity fraud and targeted phishing, and stolen credentials or signing keys could be used against BEL systems and its defense supply chain. Hacktivist groups in this space have a history of exaggerated claims. BEL has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #India #Defense #DataBreach #ThreatIntelligence
1
2
428
#HFCL update!!! HFCL: 3.6x since my March study. The thesis played out much faster than expected. Q2FY27 is out, so here’s the scorecard vs. each point 👇 Q2FY27 Revenue ₹2,542 cr (+144% YoY, +33% QoQ) PAT ₹394 cr (+448% YoY, +60% QoQ) EBITDA margin 25.9% (Q1: 23.3%, Q2FY26: 19.5%) Order book ₹28,911 cr — 64% OFC/DCI, 57% exports Thesis: product-led + export-driven ✅ Products ~85% of revenue, exports 55%+ 1. OFC exports ✅ Telecom Products revenue surged to ₹2,322 cr vs. ₹490 cr YoY. OFC sits within this segment. The $1.1bn international OFC agreement adds visibility, but it’s potential value, not firm orders yet. 2. Vertical integration ✅ Expected ~20% EBITDA margin; delivered 25.9%. New ₹1,800 cr capex will take fibre capacity to 43.1m fkm and add 600 TPA of preform capacity — integration all the way to glass. 3. Data center interconnect ✅ upgraded My note had ₹400–500 cr over FY26–27. Now ₹700–800 cr is expected in FY27 alone, capacity is going 5x, and a ₹215 cr facility has been approved. 4. Telecom equipment (₹500 cr target) ❓ Telecom Products revenue surged to ₹2,322 cr, but OFC, telecom equipment and other products aren’t separately disclosed. Can’t independently verify progress against the ₹500 cr target. 5. Defence ⚠️ behind pace Q2 revenue: ₹55 cr. Full FY26 revenue was ₹77 cr. Management says ₹500 cr in FY27 is still on track — implying ₹400 cr+ in H2. Order book: ~₹2,300 cr. The AP ammunition complex is still at an early stage. This is the one I’m watching closely. The 205x PE ✅ The trailing PE was distorted by the EPC transition and depressed earnings. Current PE is ~45x. Guidance went from 20% → 40% → 80% in just one year. That tells you a lot about demand. Risks that showed up: - H1 operating cash flow ₹455 cr vs. ₹640 cr PAT. Receivables increased by roughly ₹400–418 cr since March; after ₹449 cr capex, so working capital is soaking up cash as they scale. - EPC turnkey still bleeding: ₹123 cr EBIT loss. - Defence execution needs to step up significantly. - Capex runs into 2028. The core thesis played out much faster than expected, and margins beat expectations. The rerating may be largely done. From here, it’s about the OFC cycle, cash conversion and defence deliver.
#HFCL - HFCL Limited HFCL is transitioning toward a product-led, export-driven model, positioning itself as a supplier to global data center and AI infrastructure through high-fibre-count OFC and active networking solutions. As data center deployments scale globally, each facility requires high-fibre-count OFC networks, with HFCL supplying both the passive cable and the active networking equipment. I could find 5 catalysts: 1. OFC (Optical Fiber Cable) exports are the nearest-term catalyst where management is guiding OFC revenues to ₹3,500 Cr in FY27, driven by global hyperscaler AI infrastructure and data center build-outs, supporting sustained optical fiber demand. The critical and under-appreciated competitive edge: HFCL and subsidiary HTL are the only Indian OFC exporters completely exempt (following a six-month European Commission investigation including on-site factory inspections) from EU anti-dumping duties that hit every other Indian player (Sterlite at 11.4%, Vindhya and APAR at 8.7–9.9%) actively redirecting European order flow toward HFCL, OFC capacity expanding from 30.5 to 42.36 million fkm by June 2026. Crucially, while OFC is <0.5% of a Data Center's capex, AI clusters demand 10x more fiber volume. This tiny cost share makes hyperscalers highly price-insensitive, protecting HFCL's margins on massive orders. 2. Vertical Integration: doubled in-house fiber capacity from 14M to 28M fkm (targeting 33.9M by Dec 2026) enables 100% self-sufficiency in glass fiber. This insulates margins from raw material volatility and, combined with the 0% EU duty, supports margin stability (~20% EBITDA target) while enabling competitive bidding for hyperscaler contracts. 3. Data Center Interconnect (Moving Up the Stack): HFCL is expanding into pre-connectorised solutions (PCS) and MPO-based data center interconnect products, targeting higher-value passive infrastructure beyond standard OFC. Management expects PCS to contribute ~₹400–500 Cr incremental revenue over FY26–FY27, with growing adoption in hyperscaler and AI-driven data center deployments. Strategically, this positions HFCL to evolve from a commodity cable supplier toward an integrated optical solutions provider, improving margin profile and customer stickiness. 4. Telecom products (Wi-Fi 6, Wi-Fi 7, 5G CPEs) targeting ₹500 Cr in FY27, with HFCL being the only Indian 5G CPE manufacturer holding 90% domestic market share in unlicensed band radios and is receiving export enquiries across Europe, Africa, and the Middle East, indicating emerging international demand visibility. 5. Entering Defense and the ongoing global 155mm ammunition shortage (est. 4M+ unit annual deficit) supports a multi-year replenishment cycle, with HFCL entering the segment via its operational Hosur facility (Electronic Fuzes (Percussion, Proximity, and Time fuzes), Thermal Weapon Sights, Surveillance Radars, and High-Capacity Radio Relays (HCRR))(annual capacity: 250,000 fuzes). Following the successful completion of electronic fuze firing trials in January 2026, the company is transitioning to serial production with a management revenue target of ₹400–500 Cr in FY27 (initial scale, subject to order ramp-up). HFCL is also developing a 1,000-acre greenfield defense mega facility (high-barrier entry) in Madakasira, Andhra Pradesh, designed for Artillery Ammunition Shells, TNT Filling, and Multi-Mode Hand Grenades (MMHG) which could scale to ₹1,500 – ₹2,500 Crore+ annually by FY28–29 post phase 1 & 2. Key risks include limited visibility on large-value long-term defence contracts, execution and certification timelines, potential delays in capex commissioning, order conversion risk, near-term working capital, continued promoter stake dilution, retail-heavy shareholding leading to potential overhead supply and debt serviceability pressures during the capex cycle. (High PE of 205 because HFCL intentionally started rejecting low-margin EPC (turnkey) telecom contracts to focus on products. This caused an immediate gap in revenue. Simultaneously, they are spending heavily on capex, which combined caused losses in few quarters. PE will normalize as product revenues scale and earnings catch up)
1
4
811
Tushar Saini retweeted
🚨 A serious internet-security incident just came to light, and it involves an Indian company, eMudhra Ltd. Secret keys belonging to eMudhra, a company whose job is to help prove websites are genuine, ended up in the wrong hands. Google, Mozilla (Firefox), Apple and Microsoft have all had to step in. In this thread I'll explain what happened in plain language, why it matters, and what you need to do. 🧵
‼️ BREAKING: 8 Private keys belonging to eMudhra intermediate certificate authorities (CA) have been compromised. Chrome and Firefox blocked the affected certificates within hours. Go, NSS, and other software have issued fixes. Full details - thehackernews.com/2026/10/ei…
18
192
7
1,116
236,066
Best Cybersecurity Awareness Month ever. 😭
50
762
61
5,393
78,576
📄 Update: eMudhra Ltd has responded. It wasn't a hack. A flaw in its April 2025 key ceremony created weak keys, one of which was literally "4". The company says the global TLS business is about 1% of revenue, and Indian DSC and eSign are unaffected. But it also admits the reputational risk "cannot be quantified." For a company that sells trust, that's the part to watch. 👀
🚨 A serious internet-security incident just came to light, and it involves an Indian company, eMudhra Ltd. Secret keys belonging to eMudhra, a company whose job is to help prove websites are genuine, ended up in the wrong hands. Google, Mozilla (Firefox), Apple and Microsoft have all had to step in. In this thread I'll explain what happened in plain language, why it matters, and what you need to do. 🧵
12
23
4
227
52,036
💰 What does this mean for eMudhra's business? The surprising part is that the part of the business directly hit is tiny. eMudhra made about ₹700 crore in revenue last year (FY26). Only around 20% of that came from its "Trust Services" segment, which covers digital signatures and certificates. Within that 20%, website security certificates (the kind affected here) were only about 6%. That works out to roughly 1% of total revenue, or about ₹8–9 crore. Most of eMudhra's Trust Services money comes from Indian digital signatures (DSCs) used for GST, income tax and company filings. Those fall under India's own regulator, not Google or Mozilla. But there’s one more very important thing.
2
15
8,700
📊 why did the share price still took a hit? Because eMudhra doesn't really sell certificates. It sells trust. About 59% of its revenue comes from "Enterprise Solutions," which means helping banks, governments and other clients manage their own digital keys and identities. Around 64% of total revenue comes from outside India. Now picture a sales meeting: "Trust us to protect your keys"... from a company that just had 8 of its own keys stolen. 😬 That's the real risk:
⚠️ Clients may delay or rethink deals
⚠️ Competitors will use this against them
⚠️ If Chrome also distrusts eMudhra's remaining root, its global certificate business is effectively over
⚠️ Indian regulators may ask tough questions How much it more it will fall will depend on how eMudhra explains what happened, and how quickly.
4
21
7,415
So what should YOU do? ✅ Update your browser (Chrome, Firefox, Safari or Edge) 
✅ Update your phone and computer 
✅ Restart them if an update is waiting That's it. Most people are already protected automatically. The bigger lesson is that the whole internet runs on trust in a small group of companies. When one of them slips, our safety depends on how quickly browsers react. This time they reacted fast. 👏
2
5
46
9,216
Questions that are still unanswered: ❓ How did the keys leave eMudhra? 
❓ When did the leak happen, and was anything misused before it was caught? 
❓ Who else had access? As of Oct 20, eMudhra had not posted any public notice about the incident. Expect much more scrutiny in the coming days. 👀
2
1
24
9,765
What this means for eMudhra: Google says Chrome will stop trusting one of eMudhra's main "root" certificates (the master seal above these 8). It is also reviewing eMudhra's other root because of how serious the incident is. In this industry, trust is the whole business. History isn't kind here. DigiNotar, a Dutch CA, collapsed after a similar breach in 2011. One important distinction: eMudhra's Indian digital signature business (the DSCs used for GST, MCA and income tax filings) falls under India's own regulator and is separate from this browser-trust issue.
1
1
31
10,194
It doesn't end with browsers. Lots of apps and tools carry their own list of trusted companies, including programming languages, servers, smart devices and corporate software. Developers rushed out fixes for Go, Python, Node.js, Homebrew, Linux systems and more. If you work in IT, now is the time to check that your servers, containers and apps have the updated trust lists. 🛠️
1
30
10,592
Now the good news: the response was fast. ⚡ 📅 Saturday, Oct 17: the report reached Mozilla and Google.
🦊 Firefox blocked the stolen certificates in under 3 hours, without users needing to do anything.
🌐 Chrome blocked them the same day.
🍎 Apple followed on Oct 19, and 🪟 Microsoft on Oct 20.
eMudhra has cancelled (revoked) all 8 certificates. Google also says that no website certificates from these keys had shown up in the public logs it checks before the block. That means no fake certificate could have been trusted by default in Chrome.
2
5
45
11,320
How do we even know the keys were stolen? The person who reported it, known only as "Wayne," did something clever. He used all 8 stolen keys to sign a short message and sent it to the browser companies. Only someone holding the real keys could produce those signatures. It's like proving you have someone's house keys by sending a selfie from inside their living room. 🏠
2
1
32
12,055
Why that's dangerous: with these keys, an attacker could in theory create a fake but valid-looking certificate for any website, whether that's Google, Gmail, your bank or a government portal. If they could also get between you and the internet (for example on public Wi-Fi or through a compromised network), they could show you a fake site with a real-looking padlock. They could then read or change what you send, including passwords and messages.
1
2
32
13,265
Think of it like a passport office. The passport office has an official seal. Any passport with that seal is accepted at every airport, no questions asked. Now imagine someone steals that seal. They could make a passport for anyone, with any name, and airports would accept it as real. That's roughly what happened here. eMudhra's secret "seals" (called private keys) for 8 of its issuing offices were stolen. 🔑
1
2
37
14,018
First, how the 🔒 padlock in your browser works. When you open your bank's website, your browser has to make sure it's really your bank and not a fake site built by a scammer. To do that, websites carry a kind of digital ID card called a certificate. Special trusted companies called Certificate Authorities (CAs) issue these ID cards after checking that the website owner is who they claim to be. Your browser keeps a list of these trusted companies. If a site's ID card was issued by one of them, the browser shows the padlock and lets you in. eMudhra is one of these trusted companies.
1
2
53
15,244
Congratulations to @ryzin05 for clearing our Certified Red Team Professional exam! #ADLab #CRTP #AlteredSecurity cc @nikhil_mitt xitter.cf/AlteredSecurity/status… alteredsecurity.com/adlab
1
2
576
Tushar Saini retweeted
आज जब telecom और digital technology का इतना महत्व है... तब इससे जुड़े security framework को भी... चाक-चौबंद करना आवश्यक है। Phone की Security और Network की Security... ये हम सभी की प्राथमिकता है: PM @narendramodi
943
6,137
598
32,726
2,397,088
#PCJEWELLER - how much tight is too tight?
36
1,841