Domestic UPI Frauds: Finance Ministry Presented Data in LokSabha

Executive Summary:

QakBot, a particular kind of banking trojan virus, is capable of stealing personal data, banking passwords, and session data from a user's computer. Since its first discovery in 2009, Qakbot has had substantial modifications.

C2 Server commands infected devices and receives stolen data, which is essentially the brain behind Qakbot's operations.Qakbot employs PEDLL (Communication Files), a malicious program, to interact with the server in order to accomplish its main goals. Sensitive data, including passwords or personal information, is taken from the victims and sent to the C2 server. Referrer files start the main line of communication between Qakbot and the C2 server, such as phishing papers or malware droppers. WHOIS data includes registration details for this server, which helps to identify its ownership or place of origin.

This report specifically focuses on the C2 server infrastructure located in India, shedding light on its architecture, communication patterns, and threat landscape.

Introduction:

QakBot is also known as Pinkslipbot, QuakBot, and QBot, capable of stealing personal data, banking passwords, and session data from a user's computer. Malware is bad since it spreads very quickly to other networks, affecting them like a worm.,It employs contemporary methods like web injection to eavesdrop on customer online banking interactions. Qakbot is a member of a kind of malware that has robust persistence techniques, which are said to be the most advanced in order to gain access to compromised computers for extended periods of time.
‍

Technical Analysis: 

The following IP addresses have been confirmed as active C2 servers supporting Qbot malware activity:

‍

Sample IP's

• 123.201.40[.]112
• 117.198.151[.]182
• 103.250.38[.]115
• 49.33.237[.]65
• 202.134.178[.]157
• 124.123.42[.]115
• 115.96.64[.]9
• 123.201.44[.]86
• 117.202.161[.]73
• 136.232.254[.]46

These servers have been operational in the past 14 days (report created in the month of Nov) and are being leveraged to perpetuate malicious activities globally.

URL/IP: 123.201.40[.]112

• inetnum: 123.201.32[.]0 - 123.201.47[.]255
• netname: YOUTELE
• descr: YOU Telecom India Pvt Ltd
• country: IN
• admin-c: HA348-AP
• tech-c: NI23-AP
• status: ASSIGNED NON-PORTABLE 
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-16T06:43:19Z
• mnt-irt: IRT-IN-YOU
• source: APNIC
• irt: IRT-IN-YOU
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• e-mail: abuse@youbroadband.co.in
• abuse-mailbox: abuse@youbroadband.co.in 
• admin-c: HA348-AP
• tech-c: NI23-AP
• auth: # Filtered
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:30:51Z
• source: APNIC
• person: Harindra Akbari
• nic-hdl: HA348-AP
• e-mail: harindra.akbari@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-10T11:01:47Z
• source: APNIC
• person: NOC IQARA
• nic-hdl: NI23-AP
• e-mail: network@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:18:09Z
• source: APNIC
• route: 123.201.40.0/24
• descr: YOU Broadband & Cable India Ltd.
• origin: AS18207
• mnt-lower: MAINT-IN-YOU
• mnt-routes: MAINT-IN-YOU
• mnt-by: MAINT-IN-YOU
• last-modified: 2012-01-25T11:25:55Z
• source: APNIC

IP 123.201.40[.]112 uses the requested URL-path to make a GET request on the IP-address at port 80. "NOT RESPONDED" is the response status code for the request "C:\PROGRAM FILES GOOGLE CHROME APPLICATION CHROME.EXE" that was started by the process. 

Programs that retrieve their server data using a GET request are considered legitimate. The Google Chrome browser, a fully functional application widely used for web browsing, was used to make the actual request. It asks to get access to the server with IP 123.201.40[.]112 in order to collect its data and other resources. 

Malware uses GET requests to retrieve more commands or to send data back to the command and control servers. In this instance, it may be an attack server making the request to a known IP address with a known port number. Since the server has not replied to the request, the response status "NOT RESPONDED" may indicate that the activity was carried out with malicious intent.

This graph illustrates how the Qakbot virus operates and interacts with its C2 server, located in India and with the IP address 123.201.40[.]112. 

Impact

Qbot is a kind of malware that is typically distributed through hacked websites, malicious email attachments, and phishing operations. It targets private user information, including corporate logins or banking passwords. The deployment of ransomware: Payloads from organizations such as ProLock and Egregor ransomware are delivered by Qbot, a predecessor. Network Vulnerability: Within corporate networks, compromised systems will act as gateways for more lateral movement.

Proposed Recommendations for Mitigation

• Quick Action: To stop any incoming or outgoing traffic, the discovered IP addresses will be added to intrusion detection/prevention systems and firewalls.
• Network monitoring: Examining network log information for any attempts to get in touch with these IPs
• Email security: Give permission for anti-phishing programs.
• Endpoint Protection: To identify and stop Qbot infestations, update antivirus definitions.,Install tools for endpoint detection and response.
• Patch management: To reduce vulnerabilities that Qbot exploits, update all operating systems and software on a regular basis.
• Incident Response: Immediately isolate compromised computers.
• Awareness: Dissemination of this information to block the IP addresses of active C2 servers supporting Qbot malware activity has to be carried out.

Conclusion:

The discovery of these C2 servers reveals the growing danger scenario that Indian networks must contend with. To protect its infrastructure from future abuse, organizations are urged to act quickly and put the aforementioned precautions into place. 

Reference: 

• Threat Intelligence - ANY.RUN
• https://www.virustotal.com/gui
• https://www.virustotal.com/gui/ip-address/123.201.40.112/relations

‍

Introduction

The .com boom led to a massive surge in the expansion of digitised and automated operations in all industries and organisations, which in turn beagle a wholesome transition to the digital age for all netizens, organisations and industries. All the big techs in today’s time were startups or not even in existence back when this boom began, but just in 3-4 decades, we see that a massive faction of the global population is dependent directly or indirectly on big techs for some or the other services. As the world of tech expands, so does the big tech, and hence, in the previous decades, we have seen some acquisitions by big tech companies. The biggest acquisition by tech was last seen in 2023 when the social media giant Facebook (Now META) acquired the famous messaging platform Whatsapp for $13 Billion, but now, almost after a decade, the world is ready to witness the biggest acquisition as Adobe confirms its plans to acquire Figma the leading web-first collaborative design platform.

Adobe - Figma Acquisition  

The illustrator developer Adobe has been the pioneer in developing designing tools since 1982. The founder of the company made a switch from the paper company Xerox, and hence, the operations and products of the company have been oriented towards paper and design. But as the company is already a pioneer in developing designing and editing tools, the impact of AI cannot be underestimated. Hence, this acquisition comes at a critical juncture in impacting the AI-driven product market.  

Adobe wants to use digital experiences to transform the world. Adobe provides the tools and platforms that power the digital economy today, and over the course of its existence, its innovations have positively impacted billions of people worldwide. Adobe continues to invent and modify categories, having revolutionised photography and creative expression with Photoshop, pioneered electronic documents with PDF, and created the digital marketing category with Adobe Experience Cloud.

The goals of Figma are to facilitate visual teamwork and provide accessibility to design for all. The company, which was founded in 2012 by Dylan Field and Evan Wallace, was a pioneer in online product design. Thanks to multi-player workflows, advanced design systems, and a large, expandable developer environment, it is now enabling collaboration for anybody designing interactive mobile and online applications. Millions of fresh designers and developers, as well as a devoted student base, have been drawn to Figma.

By working together, Adobe and Figma will transform how people create and work, spur innovation on the web, improve product design, and uplift communities of creators, designers, and developers throughout the world. The combined business will have the capacity to create major value for clients, investors, and the industry, in addition to a sizable and rapidly expanding market potential.

Key Features of Acquisition

The most expensive acquisition this century has caught the attention of a lot of companies and regulatory authorities across the world. The key features of the deal are as follows: 

• Reimagining the Future of Creativity and Productivity: The designing giant Adobe and Figma coming together will unlock new potential for creativity and productivity as both of the companies create tools which are widely used; hence, they understand the customer’s requirements and expectations, thus making a path for creativity and productivity in term of new services and applications.    
• Accelerating Creativity on the Web: Adobe's Creative Cloud technologies will be delivered online more quickly thanks to Figma's web-based, multi-player features, which will increase productivity and accessibility to the creative process for more people. The current difficulty facing creators is producing an ever-increasing amount of material while working closely with an ever-increasing number of stakeholders. With its widespread use, the web is now a tool that facilitates collaborative creation in teams.
• Advancing Product Design: All parties involved in the product design process, including designers, product managers, and developers, will gain from the integration of Adobe's robust imaging, photography, illustration, video, 3D, and font technologies into the Figma platform. Because digital applications are integral to both our personal and professional lives, the product design sector is experiencing rapid expansion. 
• Inspiring and empowering the designer and developer community: The company's ongoing innovation has been fueled by the dynamic creative community at Adobe. With its vast and expanding ecosystem, Figma boasts a fervent community that creates and shares everything from templates to plug-ins to lessons. By uniting the communities of Figma and Adobe, designers and developers will be able to harness the potential of collaborative design in the future. By 2025, Figma's addressable market will reach a total of $16.5 billion. With best-in-class net dollar retention of more than 150 percent, the company is predicted to add around $200 million in net new ARR this year, topping $400 million in total ARR by the end of 2022. Figma has established a productive, rapidly expanding company with operating cash flows that are positive and gross margins of over 90%.

Conclusion

The acquisition of the decade is going to be under heavy scrutiny and checks under various laws in different countries and is expected to be given the green light soon, this merger and acquisition case study will act as a precedent for such high-value acquisitions. Nearly 10 years ago, we saw the last biggest acquisition, where Meta acquired WhatsApp for $13 Bn. As the world of tech moves forward, we will be witnessing more of such M&As in the future, but in such moments, we should be cautious about how our data is handled and transferred by the other company, always make sure you keep a check on your digital rights and responsibilities, because ultimately we are the consumers of the cyberspace.

References

• https://news.adobe.com/news/news-details/2022/Adobe-to-Acquire-Figma/default.aspx
• https://www.theregister.com/2023/10/26/regulator_delays_adobes_20bn_buy/
• https://www.reuters.com/markets/deals/adobes-deal-acquire-figma-under-threat-eu-regulators-ft-2023-06-20/'

‍

Executive Summary:

 A viral online image claims to show Arvind Kejriwal, Chief Minister of Delhi, welcoming Elon Musk during his visit to India to discuss Delhi’s administrative policies. However, the CyberPeace Research Team has confirmed that the image is a deep fake, created using AI technology. The assertion that Elon Musk visited India to discuss Delhi’s administrative policies is false and misleading.

Claim

‍

A viral image claims that Arvind Kejriwal welcomed Elon Musk during his visit to India to discuss Delhi’s administrative policies.

Post link

‍

‍

Fact Check:

Upon receiving the viral posts, we conducted a reverse image search using InVid Reverse Image searching tool. The search traced the image back to different unrelated sources featuring both Arvind Kejriwal and Elon Musk, but none of the sources depicted them together or involved any such event. The viral image displayed visible inconsistencies, such as lighting disparities and unnatural blending, which prompted further investigation.

Using advanced AI detection tools like TrueMedia.org and Hive AI Detection tool, we analyzed the image. The analysis confirmed with 97.5% confidence that the image was a deepfake. The tools identified “substantial evidence of manipulation,” particularly in the merging of facial features and the alignment of clothes and background, which were artificially generated.

  Analysis link

‍

‍

‍

Moreover, a review of official statements and credible reports revealed no record of Elon Musk visiting India to discuss Delhi’s administrative policies. Neither Arvind Kejriwal’s office nor Tesla or SpaceX made any announcement regarding such an event, further debunking the viral claim.

Conclusion:

The viral image claiming that Arvind Kejriwal welcomed Elon Musk during his visit to India to discuss Delhi’s administrative policies is a deep fake. Tools like Reverse Image search and AI detection confirm the image’s manipulation through AI technology. Additionally, there is no supporting evidence from any credible sources. The CyberPeace Research Team confirms the claim is false and misleading.

• Claim: Arvind Kejriwal welcomed Elon Musk to India to discuss Delhi’s administrative policies, viral on social media.
• Claimed on: Facebook and X(Formerly Twitter)
• Fact Check: False & Misleading

‍