the cyber shark Archives - Page 13 of 18

I4C’s ‘Pratibimb’ Module Revolutionizes Cybercrime Investigations with 6,000+ Arrests

The ‘Pratibimb’ module provides jurisdictional officials with visibility into the locations of offenders and crime infrastructure. The Lok Sabha received notice on March 11, 2025, that the Indian Cyber Crime Coordination Centre (I4C) of the Union Home Ministry had introduced the ‘Pratibimb’ module, which tracks the whereabouts of criminals and has led to 36,296 requests for help with cyber investigations, 17,185 linkages, and 6,046 accused arrests. Bandi Sanjay Kumar, Minister of State for Home Affairs, responded to a query by stating that ‘Samanvaya‘, a platform for information sharing and analysis on cybercrimes, has been introduced for Law Enforcement Agencies (LEAs). According to him, it offers data on the perpetrators and crimes linked to interstate connections in cybercrime complaints from different States and UTs. The ‘Pratibimb’ module maps the locations of offenders and crime infrastructure, giving jurisdictional officials visibility. Law Enforcement Agencies can more easily request and receive techno-legal support from I4C and other SMEs thanks to this module. 36,296 requests for assistance with cyber investigations, 17,185 links, and 6,046 accused people have been arrested as a result,” the Minister stated. He went on to say that I4C is an affiliated office established by the Ministry to coordinate and fully address all forms of cybercrimes in the nation. The state-of-the-art ‘National Cyber Forensic Laboratory (Investigation)’ was established as part of the I4C in New Delhi to provide early-stage cyber forensic support to State/UT Police Investigating Officers (IOs). According to him, the National Cyber Forensics Laboratory (Investigation) has so far assisted State/UT LEAs in about 11,835 cybercrime cases.

Cyber fraud losses in India have surged nearly 10-fold in a decade: finance ministry

Losses from Cyber fraud have more than doubled in just ten years, said Pankaj Chaudhary, Minister of State in the Union Finance Ministry, who made this announcement on 10 March 2025. Responding to a question in the Lok Sabha, Mr Chaudhary said losses due to cyber frauds would increase from ₹18.46 crore in 2014-15 to around ₹177.05 crore in 2023-24. Last year, the cost of cyber scams during the first nine months of 2025 (April-December 2024) was ₹107.21 crore. He noted that the number of cyberfrauds involving ₹1 lakh or more increased from 815 in FY15 to 29,082 in FY24. This figure was 13,384 during the first nine months of FY25. Chaudhary stated, “Incidences of fraudulent practices, including digital payment frauds, have also increased in the last few years due to the country’s growing number of digital payment transactions.” The Indian Cyber Crime Coordination Centre (I4C) of the Union Ministry of Home Affairs estimates that over ₹1.2 trillion will be lost by Indians due to cyber fraud in the coming year. The National Cybercrime Reporting Portal and the National Cybercrime Helpline Number (1930) have been established by the Union Home Ministry to assist victims of cybercrime, Chaudhary stated. According to him, the Department of Telecommunications has also launched the Digital Intelligence Platform and the “Chakshu” feature on the Sanchar Saathi website to allow people to report alleged fraudulent communications they have received through WhatsApp, SMS, or phone calls, including messages about bank account updates or KYC expiration. However, Chaudhary assigned the responsibility of preventing, detecting, investigating, and prosecuting crimes—including cybercrime—to states and union territories. “Through financial assistance and advisory services under various schemes for the capacity building of their LEAs (law enforcement agencies), the Central government complements the initiatives of the states/UTs,” he stated. By issuing alerts and advisories and conducting cybersecurity mock drills to enable evaluation of an organization’s readiness and cyber security posture, the Indian Computer Emergency Response Team (CERT-In) takes a number of steps to ensure the safe use of digital technologies and prevent cyber frauds, he continued.

Beware of Romance Scams: Protect Yourself from Online Fraud and Heartbreak

Online romance scams involve fraudsters using fake profiles to deceive victims into sending money, leading to financial and emotional harm. Stay cautious, verify profiles, and report suspicious activities to avoid falling victim. In the current digital times, where even intimate relationships can be formed online, people must accept that all that meets the eye cannot be real in an online world. Instances of a prospective life partner you meet online turning out to be a fraudster and a seemingly reliable online friend becoming an offender abound. It is therefore essential that digital users exercise care and caution as well as become aware and alert while interacting online, to save themselves from a broken heart and hole in the purse. When a fraudster uses a phoney profile to trick a victim into parting with their hard-earned money under false pretences, it’s known as an online romance scam. Dangers Trapped in fake online relations Loss of Money Blackmail Heartbreak Depression Probable causes (of online romance scams) Relying on online dating ( platforms like Tinder, bumble etc., for partners. Fake profiles on matrimonial sites A rise in the use of extramarital dating apps like Gleeden and online social meeting apps like Facebook dating Loneliness or anxiety due to isolation, especially in COVID times Potential Victims Although anyone could become a victim of this fraud (Romance Scams), the following people are frequently seen as victims: Women * Middle-aged people * Widowers People with romantic idealization (Romance Scams). People with impulsiveness and relational addiction Modus Operandi A fraudster operating with a fake profile makes contact with a potential victim (and establishes a fake relation/bond.) Before registration, make sure the dating app (Romance Scams) or matrimonial website is legitimate, and create a new email address. The fraudster convinces or makes the victims obliged to send them money online using means like gift cards, UPI payment, bank transfer, reloadable debit cards etc., on some pretext. They may seek money due to emergencies like accidents, hospitalization etc., They may ask them to invest money in bogus schemes They may convince you about good investment schemes like cryptocurrencies etc., Over time after extracting the money, they may avoid the victim completely and dump them. (Intimate pictures shared during interaction may also be used by fraudsters to extort money from victims) Warning Signs Friend requests from unknown people Expressing feelings of affection and love too soon in an online relation Being very empathetic and obliging Avoiding meeting in person Mismatch in the details shared when verified closely Seeking financial help and making requests for money/gifts on some pretext. Hypothetical Case Study In her 30s, Lata worked as a professional software developer in Hyderabad. She had registered on a popular marriage website to find a decent and attractive mate. After Rohan contacted her, Latha checked his online profile and discovered that he was a senior official at a government organization with a wealthy and well-respected family. Impressed with the profile she pursued the match with the approval of her family. After some time Rohan requested Latha to help him with some money as he was in dire need of it. Trusting him, Latha helped him out with a lot of money. It was later on when suddenly Rohan went untraceable and had switched off his mobile totally, that she identified something was wrong. After approaching the police department, she came to know that ‘Raghuveer’ alias ‘Rohan’ was a fraudster who trapped women for money and committed crimes. Safety Tips Before registration, make sure the dating app (Romance Scams) or matrimonial website is legitimate, and create a new email address. It is preferable that you do not share your details like mobile no., residential address on matrimonial sites (Romance Scams) or dating sites openly/publicly. Never share any private picture bank account or other financial details with people you have met recently. Have a thorough end-to-end background check taking ample time before you decide to proceed in relation. You can also consider taking the help of an investigation agency. Be very cautious while considering a prospective groom with an NRI profile on a matrimonial site (Romance Scams). Always personally meet the person you have known online at a public place and ask them enough questions. Never accept money requests from strangers you meet online. Do not invest in schemes etc., as per the advice received by someone you only met online; be cautious of claims/requests of exclusive investment opportunities with urgency to act fast. Always keep a neutral person informed who can gauge and assess the interaction and advise logically. Never give your bank account details, passport or identification copies, or any other private information to an unknown online person or website. Enable required privacy and security features on social media platforms and keep your information private mostly. Ensure that you do not accept friend requests by strangers at face value without proper verification. Terminate the relationship and report it if you believe it to be a scam. File a complaint about the scam at your nearest cyber crime cell and online on www.cybercrime.gov.in portal. Report or Notify the scammer on the social media site, app, or service where the scam (Romance Scams) occurred, this may help others from being victims. In case you have shared any banking-related details, follow the rules and approach the bank for necessary action. Go easy on yourself, learn the lesson and move on

Odisha Crime Branch’s Discover Rs. 87 Lakh Investment Fraud; Delhi Arrests Key Accused

The Odisha Crime Branch’s Criminal Investigation Department (CID) Cyber Crime Unit has successfully solved an investment fraud case, leading to the arrest of a major suspect in the Rs. 87 lakh scam. The victim, who worked for a private company, was added to the “101 Stock Discussion Group” WhatsApp group, where scammers pretended to be professors and other colleagues. By offering phoney stock trading advice, initial public offering (IPO) advice, and investment plans, they deceived the victim into making many deposits totalling about Rs. 87 lakh into different bank accounts. Mrs Vandana Bawa was captured in South Delhi by the CID Cyber Odisha Crime Unit following a comprehensive investigation that included the analysis of digital evidence and transaction data. An investigative team under the direction of Additional SP Ritesh Kumar Mohapatra made the arrest feasible. The accused would be transported to Odisha Crime on transit remand after appearing in the local court in Saket, New Delhi. The investigation team confiscated some incriminating items, such as a PAN card, an Aadhar card, an Indian SIM card, and a cell phone. After several bank accounts were closed, the complainant received a return of Rs. 10 lakh. The accused’s bank account was connected to two further cyber incidents in Gujarat and Kerala, according to an additional investigation of Odisha Crime. The CID is pursuing the money trail, other accomplices, and the crime’s trans-Indian repercussions. People are advised to exercise caution when they see unsolicited investment proposals on messaging applications and social media. To prevent being a victim of cyber scams, always confirm before investing. Report such issues to the local police station or the 1930 Cyber helpdesk. Protect Yourself Against Fraud Be wary of unsolicited messages and groups. Verify the authenticity of investment opportunities. Report suspicious activities immediately.

Tamil Nadu DGP’s Shreya Ghoshal Warning To Netizens

DGP Sandeep Mittal Alerts Public About Scams Involving Fake Advertisements and Compromised Celebrity Accounts on X Social media users on X (previously Twitter) have received a warning from Sandeep Mittal, the Additional Director General of Police for the Cyber Crime Wing in Tamil Nadu. He warned that false advertisements and news clips showcasing singer Shreya Ghoshal appeared on the network with dramatic headlines and deceptive connections to websites. In addition, the logos of prominent news outlets are displayed in these posts, which might easily fool readers. Sandeep Mittal, the ADGP, used X to spread the word about the problem. “Scam traps to lure the public into cyber scams are verified @X handles with 10 to 15 followers that promote Shreya Ghoshal ads,” he said. Stay vigilant and stay safe. @X ought to have a system in place to identify and stop handles that are overtly engaging in illegal activity. In the past, well-known singer Shreya Ghoshal alerted fans on Instagram that her X account had been compromised. “Hello friends and fans,” she wrote. Since February 13th, my Twitter/X account has been compromised. I have made every effort to get in touch with the X team. However, except for a few automatically created texts, there has been no response. I can’t log in anymore, so I can’t even deactivate my account.” People are urged to exercise caution and stay away from bogus links or messages from her hijacked account, as per her statement and the ADGP’s warning. Other celebrities have also been impacted by computer attacks, in addition to Shreya Ghoshal. Actor Swara Bhasker and comedian Tanmay Bhat both cited instances earlier this year in which their X accounts were compromised and used to disseminate fraudulent links.

Silk Typhoon hackers now target IT supply chains to breach networks

Microsoft cautions that the Chinese cyber-espionage threat organization “Silk Typhoon” has changed its strategy and is now attacking cloud services and remote management tools in supply chain attacks that allow it to reach downstream clients. The tech giant has verified breaches in some sectors, including energy, government, IT services, healthcare, defence, education, and non-governmental organizations. “They [Silk Typhoon] exploit unpatched applications that allow them to elevate their access in targeted organizations and conduct further malicious activities,” says the study from Microsoft. “After successfully compromising a victim, Silk Typhoon uses the stolen keys and credentials to infiltrate customer networks where they can then abuse a variety of deployed applications, including Microsoft services and others, to achieve their espionage objectives.” Silk Typhoon storms IT supply chains In early December 2024, a Chinese state-sponsored espionage outfit called Silk Typhoon gained notoriety for breaking into the U.S. Office of Foreign Assets Control (OFAC) and collecting information from the Committee on Foreign Investment in the United States (CFIUS). Around that time, according to Microsoft, Silk Typhoon changed its strategy and began misusing credentials for identity management, privileged access management, IT providers, and RMM solutions that were stolen and compromised. These credentials were then used to get access to downstream client networks and data. According to Microsoft, the hackers look through GitHub repositories and other open sources to find credentials or authentication keys that have been released, then exploit them to compromise systems. Password spray attacks are another well-known tactic used by threat actors to obtain legitimate credentials. In the past, threat actors mostly used n-day and zero-day vulnerabilities in edge devices that were visible to the public to obtain initial access, plant web shells, and then migrate laterally via compromised RDPs and VPNs. The attackers can roam around cloud environments, steal Active Directory sync credentials (AADConnect), and abuse OAuth applications for a far more covert attack when they shift from organization-level intrusions to MSP-level compromises. Threat actors no longer use web shells and malware; instead, Silk Typhoon uses cloud apps to take data and then delete records, leaving very little evidence behind. Microsoft has noted that Silk Typhoon still uses vulnerabilities, commonly known as zero days, to gain early access in addition to its new strategies. As a zero-day penetration of corporate networks, the threat organization was most recently seen taking use of a major Ivanti Pulse Connect VPN privilege escalation issue (CVE-2025-0282). Earlier in 2024, Silk Typhoon took advantage of CVE-2023-3519, a remote code execution vulnerability in Citrix NetScaler ADC and NetScaler Gateway, and CVE-2024-3400, a command injection vulnerability in Palo Alto Networks GlobalProtect. Microsoft claims that to conduct attacks and hide malicious activity, the threat actors have established a “CovertNetwork” made up of compromised Cyberoam appliances, Zyxel routers, and QNAP devices. At the bottom of its report, Microsoft has included updated indications of compromise and detection criteria that take into account Silk Typhoon’s most recent change in strategy. Defenders are advised to incorporate the information into their security tools to promptly identify and stop any attacks.

Gurugram: 7 people held for duping people over ₹87 crore in cyber frauds

Seven Cybercriminals Arrested in Gurugram for Defrauding Over ₹87 Crores in Nationwide Scam The accused were implicated in some cybercrimes, according to the police, including impersonation, cyberbullying, stalking, and fraudulent investment schemes. According to officials on 05 March 2025, seven cybercriminals who were apprehended by the Gurugram cyber police in the past two months allegedly defrauded hundreds of individuals nationwide out of over ₹87 crores. Police said they found three SIM cards, seven mobile phones, and ₹7.60 lakh in cash in their possession. The accused were implicated in some cybercrimes, according to the police, including impersonation, cyberbullying, stalking, and fraudulent investment schemes. According to Assistant Commissioner of Police (Cyber) Priyanshu Dewan, 399 cases and 10,956 complaints have been filed against the accused nationwide. Six of these instances are in Gurugram, out of the 22 cases reported in Haryana. In the past two months, all of the defendants have been taken into custody. Sonu Kumar, Ishwar, Sunil Kumar, Pawan Kumar Sharma, Neeraj, Salim, and Priya Mishra were their names, he said. Police examined data from the Indian Cyber Crime Coordination Center (I4C) and discovered that the seven cybercriminals had scammed victims nationwide out of ₹87.06 crores. The ACP stated that more research is being done on the subject.

Department of Telecommunications Issues Strong Warning Against Telecom Fraud, Enforces Harsh Penalties Under 2023 Act

The Department of Telecommunications (DoT) has issued a warning against the misuse of telecom resources, stressing penalties under the Telecommunications Act of 2023. The Act targets fraud, including SIM card tampering and identifier spoofing, with severe legal consequences. The misuse of telecom resources, such as altering or spoofing IP addresses, IMEI numbers, SMS headers, and mobile numbers, has been strongly warned against by the Department of Telecommunications (DoT). The Telecommunications Act of 2023, which stipulates severe penalties for violators, is violated by such actions, the DoT stressed. Growing Threat of Department of Telecommunications Fraud Telecom resources are increasingly being used by scammers for financial fraud and cybercrime. Illicitly obtained Subscriber Identity Module (SIM) cards and SMS headers have been used by criminals to transmit large quantities of bogus texts. To help hackers, some people also purchase SIM cards in their names and provide them to others, frequently without realizing it. SIM cards obtained through fraud, impersonation, or forged documents have also been reported. In certain cases, Points of Sale (PoS), which are in charge of issuing SIM cards, have allowed these unlawful purchases, thereby aiding and abetting the crime. Tampering with Telecom Identifiers: A Serious Crime Cybercriminals have also been seen changing telecommunication identifiers, such as the Calling Line Identity (CLI), sometimes referred to as a phone number, using mobile apps and other tools. Other crucial telecom identifiers, like IP addresses, IMEI numbers, and SMS headers, have also been changed to deliver fake messages and evade detection. Department of Telecommunications Act of 2023: Strict Legal Provisions The Telecommunications Act of 2023 imposes harsh penalties for offences related to telecommunications: Tampering with telecommunication identifiers is prohibited by Section 42(3)(c). Section 42(3)(e): Makes it illegal to obtain SIM cards or other telecom identifiers by deception, fraud, or impersonation. Section 42(7) overrides the 1973 Code of Criminal Procedure by declaring certain offences to be cognizable and non-bailable. Penalties: Violators may be fined up to Rs 50 lakh, imprisoned for up to three years, or both. Section 42(6): Those who aid or abet such offences face similar punishments. DoT’s Commitment to a Secure Telecom Ecosystem The Department of Telecommunications ( DoT ) reiterated its dedication to stopping telecom fraud through the use of cutting-edge security measures and guidelines. The department warned of harsh penalties for violators under the Department of Telecommunications Act of 2023 and asked citizens to be on guard. A safe and secure telecom ecosystem for all users is the goal of the strict legal framework, which also attempts to discourage fraudulent operations.

During the rise of DeepSeek, Elon Musk lost $90 billion; see what Bezos and Zuckerberg lost instead.

Tech billionaires lost $94 billion as a result of the Chinese AI business DeepSeek. Larry Ellison, the billionaire and chief technology officer of Oracle, lost almost $9 billion. Elon Musk, the CEO of Tesla, is among the IT giants who have lost billions of dollars as a result of China’s DeepSeek’s breakthrough achievement this year. Fortune reports that the world’s richest person lost $90 billion. According to reports, Nvidia CEO Jensen Huang and Meta CEO Mark Zuckerberg lost $20 billion and $11 billion, respectively. Nvidia was the most severely impacted by the billion-dollar AI startup’s ascent to prominence, which led to a sell-off in the AI chip manufacturer and a $600 billion decline in its market value—one of the worst decrease in US stock prices in the history of the market, according to Bloomberg. Moreover, at the beginning of February, Bloomberg assessed Musk’s net worth to be around $433 billion, but on February 28, it decreased to $349 billion. Within the same period, Zuckerberg’s net worth plummeted from $243 billion to $232 billion. Larry Ellison, the billionaire and chief technology officer of Oracle, lost almost $9 billion. According to Fortune, DeepSeek collectively wiped off $94 billion from tech billionaires’ wallets. Despite the sharp decline in his and his company’s wealth brought on by DeepSeek, Huang lauded the Chinese firm on Nvidia’s most recent earnings call, claiming it had “ignited global enthusiasm.” “It’s a great invention, but more significantly, it has made a top-notch AI reasoning model publicly available,” he stated. For a tenth of the price, DeepSeek had unveiled a sizable language model that could compete with those of competitors like OpenAI. According to CNBC, Nvidia’s biggest clients, Meta, Amazon, Google, and Microsoft, appear unfazed and plan to spend over $320 billion on AI and data centre expansion.

Massive Data Leak: AI Training Data Contains 12,000 API Keys and Passwords

Massive Data Leak : Researchers Discover Over 12,000 Exposed Credentials in Common Crawl, Highlighting Major Security Vulnerabilities for AI Models Massive Data Leak : Researchers at Truffle Security have identified approximately 12,000 valid API keys and passwords in the Common Crawl dataset, a large open-source online archive utilized for training artificial intelligence models. The dataset, which comprises petabytes of online data collected since 2008, is widely used by OpenAI, Google, Meta, Anthropic, Stability AI, and other organizations. Findings: Slack Webhooks, MailChimp API Keys, and AWS Root Keys were made public. In the December 2024 Common Crawl archive, Truffle Security examined 400 terabytes of Massive Data Leak from 2.67 billion web pages and discovered 11,908 legitimate login credentials that developers had hardcoded onto open websites. The following were among the revealed secrets: Root keys for Amazon Web Services (AWS) Almost 1,500 MailChimp API keys were leaked in JavaScript and front-end HTML. One of the WalkScore API keys was used 57,029 times in 1,871 subdomains. Slack webhooks: 17 distinct live webhook URLs are displayed on a single page. The disclosure presents a significant security concern because hackers may use these credentials to perpetrate phishing scams, impersonate brands, and illegally access private information. How Did the Secrets Get Exposed? Developers chose to hardcode API keys and credentials into JavaScript and front-end HTML rather than utilizing server-side environment variables, which led to the leak. These secrets were exposed Massive Data Leak to the public through such coding techniques, leaving them open to abuse. Sensitive information may still be incorporated into LLMs, thereby affecting their behaviour, despite efforts to filter and clean AI training datasets. Security Implications for AI and the Web Truffle Security’s observation that 63% of the secrets found were reused on several websites raised concerns over pervasive unsafe coding techniques. The researchers cautioned that AI models educated on such data may unintentionally include security flaws, posing unanticipated threats. To minimize possible harm, Truffle Security responded by contacting the impacted vendors and assisting them in rescinding or rotating thousands of compromised API keys. Call for Better Security Practices The results are a wake-up call for AI researchers and developers to implement more stringent security protocols. Important actions to prevent similar situations include avoiding hardcoded credentials, implementing environment variables, and performing frequent security audits. As AI models develop, the cybersecurity sector continues to face a significant hurdle: ensuring that training datasets are free of sensitive data.

the cyber shark