#FactCheck - The video of Virat Kohli promoting online casino mobile app is a deep fake.

In the tapestry of our modern digital ecosystem, a silent, pervasive conflict simmers beneath the surface, where the quest for cyber resilience seems Sisyphean at times. It is in this interconnected cyber dance that the obscure orchestrator, StripedFly, emerges as the maestro of stealth and disruption, spinning a complex, mostly unseen web of digital discord. StripedFly is not some abstract concept; it represents a continual battle against the invisible forces that threaten the sanctity of our digital domain.

This saga of StripedFly is not a tale of mere coincidence or fleeting concern. It is emblematic of a fundamental struggle that defines the era of interconnected technology—a struggle that is both unyielding and unforgiving in its scope. Over the past half-decade, StripedFly has slithered its way into over a million devices, creating a clandestine symphony of cybersecurity breaches, data theft, and unintentional complicity in its agenda. Let's delve deep into this grand odyssey to unravel the odious intricacies of StripedFly and assess the reverberations felt across our collective pursuit of cyber harmony.

The StripedFly malware represents the epitome of a digital chameleon, a master of cyber camouflage, masquerading as a mundane cryptocurrency miner while quietly plotting the grand symphony of digital bedlam. Its deceptive sophistication has effortlessly skirted around the conventional tripwires laid by our cybersecurity guardians for years. The Russian cybersecurity giant Kaspersky's encounter with StripedFly in 2017 brought this ghostly figure into the spotlight—hitherto, a phantom whistling past the digital graveyard of past threats.

How Does it work 

Distinctive in its composition, StripedFly conceals within its modular framework the potential for vast infiltration—an exploitation toolkit designed to puncture the fortifications of both Linux and Windows systems. In an emboldened maneuver, it utilizes a customized version of the EternalBlue SMBv1 exploit—a technique notoriously linked to the enigmatic Equation Group. Through such nefarious channels, StripedFly not only deploys its malicious code but also tenaciously downloads binary files and executes PowerShell scripts with a sinister adeptness unbeknownst to its victims.

Despite its insidious nature, perhaps its most diabolical trait lies in its array of plugin-like functions. It's capable of exfiltrating sensitive information, erasing its tracks, and uninstalling itself with almost supernatural alacrity, leaving behind a vacuous space where once tangible evidence of its existence resided.

In the intricate chess game of cyber threats, StripedFly plays the long game, prioritizing persistence over temporary havoc. Its tactics are calculated—the meticulous disabling of SMBv1 on compromised hosts, the insidious utilization of pilfered keys to propagate itself across networks via SMB and SSH protocols, and the creation of task scheduler entries on Windows systems or employing various methods to assert its nefarious influence within Linux environments.

The Enigma around the Malware

This dualistic entity couples its espionage with monetary gain, downloading a Monero cryptocurrency miner and utilizing the shadowy veils of DNS over HTTPS (DoH) to camouflage its command and control pool servers. This intricate masquerade serves as a cunning, albeit elaborate, smokescreen, lulling security mechanisms into complacency and blind spots.

StripedFly goes above and beyond in its quest to minimize its digital footprint. Not only does it store its components as encrypted data on code repository platforms, deftly dispersed among the likes of Bitbucket, GitHub, and GitLab, but it also harbors a bespoke, efficient TOR client to communicate with its cloistered C2 server out of sight and reach in the labyrinthine depths of the TOR network.

One might speculate on the genesis of this advanced persistent threat—its nuanced approach to invasion, its parallels to EternalBlue, and the artistic flare that permeates its coding style suggest a sophisticated architect. Indeed, the suggestion of an APT actor at the helm of StripedFly invites a cascade of questions concerning the ultimate objectives of such a refined, enduring campaign.

How to deal with it 

To those who stand guard in our ever-shifting cyber landscape, the narrative of StripedFly is a clarion call. StObjective reminders of the trench warfare we engage in to preserve the oasis of digital peace within a desert of relentless threats. The StripedFly chronicle stands as a persistent, looming testament to the necessity for heeding the sirens of vigilance and precaution in cyber practice.

Reaffirmation is essential in our quest to demystify the shadows cast by StripedFly, as it punctuates the critical mission to nurture a more impregnable digital habitat. Awareness and dedication propel us forward—the acquisition of knowledge regarding emerging threats, the diligent updating and patching of our systems, and the fortification of robust, multilayered defenses are keystones in our architecture of cyber defense. Together, in concert and collaboration, we stand a better chance of shielding our digital frontier from the dim recesses where threats like StripedFly lurk, patiently awaiting their moment to strike.

References:

https://thehackernews.com/2023/11/stripedfly-malware-operated-unnoticed.html?m=1

‍

Introduction
‍

India's digital governance system is experiencing a significant transformation. The Department of Telecommunications (DoT) has extended the deadline for implementing SIM binding requirements for messaging platforms to December 31, 2026, while also stepping back from earlier proposals such as mandatory periodic web logouts. 

The government extended the current proposal but decided to cancel its previous requirement, which mandated messaging platforms to implement mandatory logout periods. The authorities implemented this action to control the increasing occurrence of digital impersonation, financial fraud, online scams and identity theft, which occurs through messaging applications.

The authorities are said to have implemented this action to control the increasing occurrence of digital impersonation, financial fraud, online scams and identity theft, which occurs through messaging applications.
‍

What Has Changed
‍

The SIM binding mandate, which the Telecommunication Cyber Security framework introduced in late 2025 requires messaging platforms to maintain user account connections with active SIM cards that match their registered mobile numbers. 

Platforms received a brief period for compliance with the original rules. Industry stakeholders, which included messaging services and device manufacturers, reported that they faced major technical and operational problems when trying to constantly verify SIM status on different devices and operating systems. 

The government postponed the compliance date to December 2026 to give organisations extra time for the gradual implementation of requirements. The policy now permits platforms to use risk-based or adaptive logout mechanisms, which enable security management without enforcing standard security procedures through their web messaging application platforms. 

‍

Why the Extension Was Necessary
‍

The extension operates as a recognition of both technical feasibility constraints and ecosystem's complex nature. Multiple devices at present enable messaging platforms to function which includes smartphones and desktops and web interfaces with real time synchronization. The system needs complete operational system and hardware component integration to maintain active SIM verification throughout all environments because stakeholders estimated that this process would take time to achieve proper results. 

The operating system providers and smartphone manufacturers expressed their worries about system limitations, which include testing procedures and compatibility problems. 

The government recognised through its deadline extension that security requirements need technical feasibility and scalability to function properly without causing service interruptions or requiring immediate implementation.

‍

Security Rationale Behind SIM Binding
‍

The SIM binding system serves its main purpose to enhance accountability while it protects digital communication systems from unauthorised use. Authorities have identified that messaging accounts can remain active even after the associated SIM card is removed, deactivated, or moved across regions. The situation creates paths for criminals to commit fraud and impersonation while perpetrating cybercrime across international borders because they can use digital identities that are hard to trace. 

The SIM binding system exists to solve this problem by 

• requiring active, Virtual KYC-verified SIMs to authenticate messaging accounts. 
• Users cannot access the system until they connect their active SIM. 
• The system maintains the capacity to track and authenticate digital identities. 

The measure aims to eliminate a security gap that digital communication systems currently use for fraudulent activities and identity theft.

‍

Shift Toward Risk-Based Regulation
‍

The current development marks a major change because it no longer applies fixed rules that used to determine what organisations must do, but now uses risk assessment methods. The previous plan, which required users to log out every six hours from web sessions, has been replaced by platforms that now log users out based on their risk assessment. The shift demonstrates that cybersecurity needs to implement security measures that require specific context and need to match the existing environment. Organisations face challenges when trying to apply standard rules because users exhibit various behaviours while using different devices on multiple platforms. 

The risk-based model enables platforms to detect suspicious activity through dynamic monitoring, which establishes strict security measures for high-risk situations while preserving system access during periods of low risk.

‍

Implications for the Digital Ecosystem
‍

The extension, together with its related policy alterations, creates significant effects for organisations. The extra time allows the industry to create systems that can work together with different ecosystems while testing their implementation process and matching their required operational standards. 

The shift shows policymakers that they should adopt a process that combines multiple rounds of assessment with stakeholder input to develop their regulations. 

The upcoming changes will create invisible effects for users, which will determine the future methods of digital identity verification and the security functions of communication platforms.

‍

Conclusion
‍

The extension of the SIM binding deadline represents a new approach to regulations instead of being a regulatory rollback. The process requires both dedicated efforts and actual implementation to create secure digital environments. 

India needs to establish secure and scalable user-friendly systems while advancing its digital infrastructure development. The current developments show progress toward achieving a solution that protects cybersecurity needs while considering technological facts and user experience. Organisations face two main obstacles in modern interdependent systems: they must protect their systems while maintaining user trust and system protection, and their capability to operate over extended periods.
‍

References
‍

• https://www.thehindu.com/sci-tech/technology/government-shelves-periodic-web-logout-for-chat-apps-extends-sim-binding-to-december-31/article70811929.ece
• https://www.gadgets360.com/telecom/news/dot-sim-binding-mandate-extension-2026-report-11301917

‍

Introduction

Misinformation is rampant all over the world and impacting people at large. In 2023, UNESCO commissioned a survey on the impact of Fake News which was conducted by IPSOS. This survey was conducted in 16 countries that are to hold national elections in 2024 with a total of 2.5 billion voters and showed how pressing the need for effective regulation had become and found that 85% of people are apprehensive about the repercussions of online disinformation or misinformation. UNESCO has introduced a plan to regulate social media platforms in light of these worries, as they have become major sources of misinformation and hate speech online. This action plan is supported by the worldwide opinion survey, highlighting the urgent need for strong actions. The action plan outlines the fundamental principles that must be respected and concrete measures to be implemented by all stakeholders associated, i.e., government, regulators, civil society and the platforms themselves. 

The Key Areas in Focus of the Action Plan

The focus area of the action plan is on the protection of the Freedom of Expression while also including access to information and other human rights in digital platform governance. The action plan works on the basic premise that the impact on human rights becomes the compass for all decision-making, at every stage and by every stakeholder. Groups of independent regulators work in close coordination as part of a wider network, to prevent digital companies from taking advantage of disparities between national regulations. Moderation of content as a feasible and effective option at the required scale, in all regions and all languages. 

The algorithms of these online platforms, particularly the social media platforms are established, but it is too often geared towards maximizing engagement rather than the reliability of information. Platforms are required to take on more initiative to educate and train users to be critical thinkers and not just hopers. Regulators and platforms are in a position to take strong measures during particularly sensitive conditions ranging from elections to crises, particularly the information overload that is taking place.

Key Principles of the Action Plan

1. Human Rights Due Diligence: Platforms are required to assess their impact on human rights, including gender and cultural dimensions, and to implement risk mitigation measures. This would ensure that the platforms are responsible for educating users about their rights.
2. Adherence to International Human Rights Standards: Platforms must align their design, content moderation, and curation with international human rights standards. This includes ensuring non-discrimination, supporting cultural diversity, and protecting human moderators.
3. Transparency and Openness: Platforms are expected to operate transparently, with clear, understandable, and auditable policies. This includes being open about the tools and algorithms used for content moderation and the results they produce.
4. User Access to Information: Platforms should provide accessible information that enables users to make informed decisions. 
5. Accountability: Platforms must be accountable to their stakeholders which would include the users and the public, which would ensure that redressal for content-related decisions is not compromised. This accountability extends to the implementation of their terms of service and content policies.

Enabling Environment for the application of the UNESCO Plan

The UNESCO Action Plan to counter misinformation has been created to create an environment where freedom of expression and access to information flourish, all while ensuring safety and security for digital platform users and non-users. This endeavour calls for collective action—societies as a whole must work together. Relevant stakeholders, from vulnerable groups to journalists and artists, enable the right to expression. 

Conclusion

The UNESCO Action Plan is a response to the dilemma that has been created due to the information overload, particularly, because the distinction between information and misinformation has been so clouded. The IPSOS survey has revealed the need for an urgency to address these challenges in the users who fear the repercussions of misinformation. 

The UNESCO action plan provides a comprehensive framework that emphasises the protection of human rights, particularly freedom of expression, while also emphasizing the importance of transparency, accountability, and education in the governance of digital platforms as a priority. By advocating for independent regulators and encouraging platforms to align with international human rights standards, UNESCO is setting the stage for a more responsible and ethical digital ecosystem. 

The recommendations include integrating regulators through collaborations and promoting global cooperation to harmonize regulations, expanding the Digital Literacy campaign to educate users about misinformation risks and online rights, ensuring inclusive access to diverse content in multiple languages and contexts, and monitoring and refining tech advancements and regulatory strategies as challenges evolve. To ultimately promote a true online information landscape.

Reference

• https://www.unesco.org/en/articles/online-disinformation-unesco-unveils-action-plan-regulate-social-media-platforms
• https://www.unesco.org/sites/default/files/medias/fichiers/2023/11/unesco_ipsos_survey.pdf ‍
• https://dig.watch/updates/unesco-sets-out-strategy-to-tackle-misinformation-after-ipsos-survey