K-Electric Ransomware Attack: 7 Myths vs Facts About the 2020 Netwalker Hack

Ask people in Karachi about the K-Electric ransomware attack of September 2020 and many will tell you hackers "cut the city's power." That never happened. The attack froze billing and online complaint systems, while Dawn reported that the electricity supply itself kept running.

This case study takes seven popular beliefs about the attack and tests each one against the public record. In this post you will find:

• A day-by-day timeline in Pakistan time, from the first outage to the data leak
• How the Netwalker ransomware gang operated, explained for the people who defend networks
• What was at stake: a $3.85 million demand and an 8.5 GB leak
• Who was blamed, what was proven in court, and what is still unknown
• Eight lessons Pakistani firms can act on this month

Seven Myths About the K-Electric Ransomware Attack

Attack stories grow as they travel. A billing outage becomes a blackout. A ransom demand becomes a payment. The table below sets each common claim about the K-Electric ransomware incident beside what reporters, the company and US prosecutors actually said. The rest of this post works through them one by one.

What Happened in Karachi in September 2020?

K-Electric is the private company that supplies electricity to Karachi. At the time, BleepingComputer described it as serving 2.5 million customers with more than 10,000 staff. That scale is what made the outage visible so quickly. Here is the K-Electric ransomware sequence, with dates in Pakistan Standard Time (PKT, UTC+5) where known.

The "about Sep 15" row is an estimate. BleepingComputer's September 8 report said the price would rise after seven more days, without giving a calendar date.

Myth 1: Did the Hackers Switch Off Karachi's Power?

No. Every reliable report from that week separates the two. Dawn wrote that some services were frozen while supply was unaffected. BleepingComputer, quoting the Pakistani security firm Rewterz, said the same.

What customers did lose was the ability to reach the company online. According to Dawn, people could not log outage or fault complaints through the 118 helpline, the 8119 SMS service or the KE Live App. Duplicate bills were also hard to download from the website.

K-Electric said it had "isolated few non-critical services" as a precaution. By September 9, ProPakistani reported that bill payment and the 118 call centre were fully working again. Customers who needed a duplicate bill were told to visit a customer care centre.

Why did the grid keep running? The company never published a technical explanation. In many utilities, the systems that control generation and distribution sit on networks kept apart from office and billing IT. That is general industry context, not a confirmed fact about K-Electric's design, so treat it as a likely reason rather than a finding.

How Did the Netwalker Ransomware Attack Work?

K-Electric never disclosed how the attackers got in, and BleepingComputer's report did not say either. What we do know is how Netwalker crews generally worked in 2020, because the FBI described it in a public alert. Use it as a pattern for defense, not as a replay of this breach.

A Criminal Business With Affiliates

The US Justice Department explained that Netwalker ran on a ransomware-as-a-service model. Developers built and maintained the malware. Affiliates chose targets and carried out the intrusions. When a victim paid, the two sides split the money.

Getting a Foothold

The FBI flash alert of July 28, 2020 listed four common ways in. Crews sent phishing emails themed around COVID-19. They exploited unpatched VPN appliances, including a known Pulse Secure flaw. They abused vulnerable web application components. They also logged in through Remote Desktop accounts with weak passwords. Each of these is a gap that a patch, a setting or a short training class can close.

Stealing, Then Encrypting

Once inside, the FBI said, Netwalker crews collected administrator credentials and copied data out to file-sharing services. Only then did they launch the encryption step across connected Windows machines. This is the double extortion model. The victim faces two threats at once: locked systems and a public leak of stolen files.

That order matters for you as a defender. By the time a ransom note appears, the data may already be gone. Restoring from backup fixes the outage, but it does nothing about the leak.

Money and Data: What Did the Attack Actually Cost?

Start with the K-Electric ransomware demand. BleepingComputer saw the gang's payment page on the Tor network, which asked for $3,850,000 in Bitcoin. If unpaid after seven more days, the price would double to $7.7 million. Dawn rounded these to $3.8 million and $7 million. The difference is only rounding; the BleepingComputer figures come straight from the payment page, so they are the more precise pair.

Myth 3: "No Data Left the Company"

On September 11, K-Electric said its initial investigation showed that "all customer data has remained intact and secure." Three weeks later, the story changed. BleepingComputer reported on October 1 that Netwalker had published an 8.5 GB archive it said came from the attack.

Rewterz reviewed the archive and said it held financial data, customer information, engineering reports and maintenance logs. Security Affairs added that it included engineering diagrams for turbines. K-Electric did not reply to BleepingComputer's request for comment on the leak.

How do you weigh these two accounts? The company spoke within days, early in its own checks. The leak came weeks later and was described by an independent security firm. PSTA has not examined the files, and you should never download leaked data to check for yourself.

Myth 4: "K-Electric Paid the Ransom"

There is no public evidence of a payment. K-Electric's spokesperson, Mahreen Khan, told BleepingComputer the company had "not been directly approached" with a ransom request. Security Affairs reported that the company did not pay. Gangs usually publish stolen files when a victim refuses, which fits that reading. Still, K-Electric itself has not said, so this stays an analyst view.

No public figure exists for the cost of recovery, lost staff hours or outside experts. Be cautious with any number you see that does not name its source.

Who Was Behind It, and How Sure Is Anyone?

Confidence that the K-Electric ransomware attack was a Netwalker operation is high. BleepingComputer saw the gang's own Tor payment page naming the victim. Anonymous security sources confirmed it to the site. The gang later posted the stolen archive on its leak site. Crime groups rarely claim attacks they did not carry out. Their business depends on victims believing them.

Which person or affiliate ran the intrusion is unknown. No court record, police statement or company report names one.

Myth 5: "A Foreign Government Did It"

Nothing in the record backs this up. No government, in Pakistan or abroad, has attributed the K-Electric cyber attack to a state actor. The ransom demand and the leak threat point to a gang that wanted money. In the Bybit hack, by contrast, the FBI blamed North Korea openly.

What Happened After the Attack?

K-Electric said it was working with foreign security experts and local police on a forensic review. As far as we could find, no technical post-mortem was ever made public.

The bigger moves came from outside Pakistan. On January 10, 2021, US authorities seized about $454,530 in cryptocurrency from three Netwalker ransom payments. On January 27, 2021, the Justice Department announced a coordinated action. Bulgarian police took down a dark web site the affiliates used to talk to victims. A Canadian man, Sebastien Vachon-Desjardins, was charged in Florida; the indictment alleged he obtained at least $27.6 million.

Canadian police arrested him in Gatineau the same day and seized 719 Bitcoin. On October 4, 2022, a US court sentenced him to 20 years in prison and ordered $21.5 million forfeited.

Myth 6: "He Was the One Who Hit K-Electric"

The Justice Department never linked him to Karachi. Netwalker had many affiliates and, prosecutors said, hundreds of victims in numerous countries. Treat any claim that this case "solved" the K-Electric attack as unproven.

Myth 7: "The Danger Ended With Netwalker"

Brands die; methods survive. Less than a year later, Pakistan's tax authority faced its own crisis, covered in our FBR cyber attack case study. The tools change names, but phishing, unpatched remote access and stolen passwords keep showing up.

What a Ransomware Attack in Pakistan Means for You

For households, the main risk is what happens to personal data after a leak. Dawn pointed out that K-Electric bills carry names, addresses and CNIC and NTN numbers. Data like that helps scammers sound convincing on the phone. If someone calls about your electricity account and asks for an OTP or payment, hang up and call the official number yourself. The scripts these callers use are listed in our fraud calls in Pakistan guide.

For businesses, the lesson is wider. In 2020, experts quoted by Dawn said Pakistan had no clear redress mechanism for breach victims, and the data protection bill was still a draft. Card data was also at the center of the Pakistan bank data breach two years earlier. Any company that keeps customer records is a target, whether it sells power, phones or clothes.

It also helps to compare outcomes. In the Colonial Pipeline hack, an IT intrusion led a US company to pause physical operations. In Karachi, physical supply continued while customer-facing systems struggled. A good response plan covers both kinds of damage.

Eight Lessons in Ransomware Protection for Businesses

These lessons come from the FBI's Netwalker guidance and from the gaps the K-Electric ransomware case exposed. None needs a large budget to start.

1. Patch remote access first. VPN gateways and web portals face the internet, so fix their known flaws before anything else.
2. Close or lock down Remote Desktop. Never expose it directly to the internet, and require two-factor sign-in for every remote account.
3. Train staff with real examples. Netwalker used topical phishing lures. Show your team what current local scams look like.
4. Keep offline backups and test them. The FBI advises backups that cannot be changed or deleted from the main network. Until you have restored from it once, you cannot be sure it works.
5. Separate business IT from operations. Billing, email and office systems should not share a flat network with equipment that keeps your service running.
6. Watch outbound traffic. Large uploads to file-sharing sites can be the first sign of double extortion, before any file is encrypted.
7. Prepare your public statements. K-Electric's message shifted over several days. Decide in advance who speaks, what you can confirm and how you will correct earlier statements.
8. Collect less personal data. Every CNIC copy you store is something you may one day have to explain. Keep only what the law and the job require.

If a ransom note appears on a screen in your office, the first hour decides a lot. Work through these steps in order:

1. Disconnect the affected machines from the network so the damage cannot spread.
2. Check outbound logs for large uploads, since data may have left before the note appeared.
3. Ask one question: do you have tested offline backups? If yes, clean the systems and restore. If no, call incident response experts.
4. Report the attack. In Pakistan, cybercrime goes to the NCCIA, the National Cyber Crime Investigation Agency.
5. Tell customers what you know and what you don't, and update them as facts change.

The FBI advises against paying, because payment does not guarantee recovery and funds more attacks.

Tracing a Ransomware Case in PSTA's Cyber Security Course

Reading about an incident is useful. Rebuilding its timeline from public evidence is where real understanding starts. That is the habit PSTA's Cyber Security and Ethical Hacking course tries to build.

It is a 12-week, beginner-level course, and no earlier security background is required. You can join live online from anywhere in Pakistan or attend on campus in Abbottabad. Lessons start with the CIA triad and risk, then cover common attacks and network defenses such as firewalls and intrusion detection. Later modules deal with malware, threat detection, digital forensics and Pakistani cyber law.

One lab asks you to look into an incident, keep the evidence safe and write up a timeline, much like the K-Electric ransomware table above. The course ends with a case-study project and a security report.

If you later want to test systems from the attacker's side, with permission, you can move on to the 12-week Advanced Ethical Hacking and Penetration Testing course. Earlier cases in this series, starting with the Binance hack explainer, make good practice material for the same exercise. For batch dates, PSTA answers questions on WhatsApp at +92 314 5424399.

Test One Backup Restore Before Friday

The K-Electric ransomware case shows that systems can be restored in days, while leaked data stays out of your hands for good. You can act on half of that right now. Choose one folder your office cannot work without. Restore it from backup onto a different computer and note the minutes it needs. If the restore fails or drags on all day, you have found your most urgent security task, and you found it before an attacker did.