#FactCheck -AI-Generated Video Falsely Attributes Communal Remarks to Suvendu Adhikari; Fact Check Finds No Authentic Evidence

Introduction

Iran stands as a nation poised at the threshold of a transformative era. The Islamic Republic, a land of ancient civilisations now grappling with the exigencies of the 21st century, is now making strides in the emerging field of artificial intelligence (AI). This is not merely an adoption of new tools; it is a strategic embrace, a calculated leap into the digital unknown, where the potential for economic growth and security enhancement resonates with the promise of a redefined future.

Embarking on this technological odyssey, Iranian President Ebrahim Raisi, in a conclave with the nation’s virtual business activists, delineated the ‘big steps’ being undertaken in the realm of AI. The gathering, as reported by the pro-government Tasnim News, was not a simple exchange of polite remarks but a profound discourse that offered an incisive overview of the burgeoning digital economy and the strides Iran is making in the AI landscape. The conversation deeply revolved around the current ecosystem of technology and innovation within Iran, delving into the burgeoning startup culture and the commendable drive within its youth populace to propel the nation to the forefront of technology.

Iranian AI Integration

Military Implications

The discourse ranged from the current technological infrastructure to the broader implications for the security and defense of the region. The Iranian polity, with its rich history that seamlessly blends with aspirations for the future, is acutely aware that the implications of AI reach far beyond mere economic growth. They extend into the very fibres of military might and the structure of national security. The investment in cyber capabilities in Iran is well-documented, a display of shrewdness and pragmatism. And the integration of AI technologies is the next logical step in an ever-evolving defense architecture. Brigadier General Alireza Sabahifard, Commander of the Iranian Army Air Defense Force, has underscored the pivotal role of AI in modern warfare. He identifies the ongoing adoption of AI technologies as a strategic imperative, a top priority fundamentally designed to elevate the air defense capabilities in Iran to meet 21st-century threats.

Economic Implications

Yet, the Iranian pursuit of AI is not solely confined to bolstering military prowess. It is also pervasive in nurturing economic opportunity. President Raisi’s rhetoric touches upon economic rejuvenation, job creation, and the proliferation of financial and legal support mechanisms, all blurred into a cohesive vision that would foster a suitable environment for the private sector in the AI domain. The ambition is grand and strikingly clear — a nation committed to training several thousand individuals in the digital economy sector, signaling a deep-rooted commitment to cultivating a healthy environment  for AI-driven innovation.

The Iranian leader’s vision extends beyond the simple creation of infrastructure. It extends to the fostering of a healthy, competitive, and peaceful social milieu where domestic and international markets are within easy reach, promoting the prosperity of the digital economy and its activists. Such a vision of technological symbiosis, in many Western democracies, would be labelled as audaciously progressive. In Iran, however, withdrawing a major chunk of economic investments from the country's security state adds layers of complexity and nuance to this transformative narrative.

Cultural Integration

Still, Iran’s ambitious AI journey unfolds with a recognition of its cultural underpinnings and societal structure. The Nexus between the private sector, with its cyber-technocratic visionaries, and the regime, with its omnipresent ties to the Islamic Revolutionary Guard Corps, is a tightrope that requires unparalleled poise and vigilance.

Moreover, in the holy city of Qom, a hub of intellectual fervour and the domicile of half of Iran's 200,000 Shia clerics, there burgeons a captivating interest in the possible synergies between AI and theological study. The clerical establishment, hidden within a stronghold of religious scholarship, perceives AI not as a problem but as a potential solution, a harbinger of progress that could ally with tradition. It sees in AI the potential of parsing Islamic texts with newfound precision, thereby allowing religious rulings, or fatwas, to resonate with the everchanging   Iranian society. This integration of technology is a testament to the dynamic interplay between tradition and modernity.

Yet the integration of AI into the venerable traditions of societies such as Iran's is threaded with challenges. Herein lays the paradox, for as AI is poised to potentially bolster religious study, the threat of cultural dissolution remains present. AI, if not judiciously designed with local values and ethics in mind, could inadvertently propagate an ideology at odds with local customs, beliefs, and the cornerstone principles of a society.

Natural Resources

Similarly, Iran's strategic foray into AI extends into its sovereign dominion—the charge of its natural resources. As Mehr News Agency reports, the National Iranian Oil Company (NIOC) is on the cusp of pioneering a joint venture with international tech juggernauts, chiefly Chinese companies, to inject the lifeblood of AI into the heart of its oil and gas production processes. This grand undertaking is nothing short of a digital renaissance aimed at achieving 'great reforms’ and driving a drastic 20% improvement in efficiency. AI’s algorithmic potency, unleashed in the hydrocarbon fields, promises to streamline expenses, enhance efficacy, and maximise production outputs, thereby bolstering Iran's economic bulwark.

The AI way Forward

As we delve further into Iran's sophisticated AI strategy, we observe an approach that is both vibrant and multi-dimensional. From military development to religious tutelage, from the diligent charge of the environment to the pursuit of sustainable economic development, Iran's AI ventures are emblematic of the broader global discourse. They mark a vivid intersection of AI governance, security, and the future of technological enterprise, highlighting the evolution of technological adoption and its societal, ethical, and geopolitical repercussions.

Conclusion

The multifaceted nature of Iran's AI pursuits encapsulates a spectrum of strategic imperatives, bringing the spearheads of defense modernisation and religious academics with the imperatives of resource allocation. It reflects a nuanced approach to the adoption and integration of technology, adjudicating between the venerable pillars of traditional values and the inexorable forces of modernisation. As Iran continues to delineate and traverse its path through the burgeoning landscape of AI, attending global stakeholders, watch with renewed interest and measured apprehension. Mindful of the intricate geopolitical implications and the transformative potential inherent in Iran's burgeoning AI endeavours, the global community watches, waits, and wonders at what may emerge from this ancient civilisation’s bold, resolute strides into the future.

References

- https://www.fdd.org/analysis/op_eds/2024/03/17/irans-president-wants-new-focus-on-artificial-intelligence/

- https://www.jpost.com/middle-east/article-792391

- https://www.ft.com/content/9c1c3fd3-4aea-40ab-977b-24fe5527300c

- https://www.foxnews.com/world/iran-looks-ai-weather-western-sanctions-help-military-fight-cheap

‍

Executive Summary

This report analyses a recently launched social engineering attack that took advantage of Microsoft Teams and AnyDesk to deliver DarkGate malware, a MaaS tool. This way, through Microsoft Teams and by tricking users into installing AnyDesk, attackers received unauthorized remote access to deploy DarkGate that offers such features as credential theft, keylogging, and fileless persistence. The attack was executed using obfuscated AutoIt scripts for the delivery of malware which shows how threat actors are changing their modus operandi. The case brings into focus the need to put into practice preventive security measures for instance endpoint protection, staff awareness, limited utilization of off-ice-connection tools, and compartmentalization to safely work with the new and increased risks that contemporary cyber threats present.

Introduction

Hackers find new technologies and application that are reputable for spreading campaigns. The latest use of Microsoft Teams and AnyDesk platforms for launching the DarkGate malware is a perfect example of how hackers continue to use social engineering and technical vulnerabilities to penetrate the defenses of organizations. This paper focuses on the details of the technical aspect of the attack, the consequences of the attack together with preventive measures to counter the threat.

Technical Findings

1. Attack Initiation: Exploiting Microsoft Teams

The attackers leveraged Microsoft Teams as a trusted communication platform to deceive victims, exploiting its legitimacy and widespread adoption. Key technical details include:

• Spoofed Caller Identity: The attackers used impersonation techniques to masquerade as representatives of trusted external suppliers.
• Session Hijacking Risks: Exploiting Microsoft Teams session vulnerabilities, attackers aimed to escalate their privileges and deploy malicious payloads.
• Bypassing Email Filters: The initial email bombardment was designed to overwhelm spam filters and ensure that malicious communication reached the victim’s inbox.

2. Remote Access Exploitation: AnyDesk

After convincing victims to install AnyDesk, the attackers exploited the software’s functionality to achieve unauthorized remote access. Technical observations include:

• Command and Control (C2) Integration: Once installed, AnyDesk was configured to establish persistent communication with the attacker’s C2 servers, enabling remote control.
• Privilege Escalation: Attackers exploited misconfigurations in AnyDesk to gain administrative privileges, allowing them to disable antivirus software and deploy payloads.
• Data Exfiltration Potential: With full remote access, attackers could silently exfiltrate data or install additional malware without detection.

3. Malware Deployment: DarkGate Delivery via AutoIt Script

The deployment of DarkGate malware utilized AutoIt scripting, a programming language commonly used for automating Windows-based tasks. Technical details include:

• Payload Obfuscation: The AutoIt script was heavily obfuscated to evade signature-based antivirus detection.
• Process Injection: The script employed process injection techniques to embed DarkGate into legitimate processes, such as explorer.exe or svchost.exe, to avoid detection.
• Dynamic Command Loading: The malware dynamically fetched additional commands from its C2 server, allowing real-time adaptation to the victim’s environment.

4. DarkGate Malware Capabilities

DarkGate, now available as a Malware-as-a-Service (MaaS) offering, provides attackers with advanced features. Technical insights include:

• Credential Dumping: DarkGate used the Mimikatz module to extract credentials from memory and secure storage locations.
• Keylogging Mechanism: Keystrokes were logged and transmitted in real-time to the attacker’s server, enabling credential theft and activity monitoring.
• Fileless Persistence: Utilizing Windows Management Instrumentation (WMI) and registry modifications, the malware ensured persistence without leaving traditional file traces.
• Network Surveillance: The malware monitored network activity to identify high-value targets for lateral movement within the compromised environment.

5. Attack Indicators

Trend Micro researchers identified several indicators of compromise (IoCs) associated with the DarkGate campaign:

• Suspicious Domains: example-remotesupport[.]com and similar domains used for C2 communication.

• Malicious File Hashes:some text
  • AutoIt Script: 5a3f8d0bd6c91234a9cd8321a1b4892d
  • DarkGate Payload: 6f72cde4b7f3e9c1ac81e56c3f9f1d7a
• Behavioral Anomalies:some text
  • Unusual outbound traffic to non-standard ports.
  • Unauthorized registry modifications under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Broader Cyber Threat Landscape

In parallel with this campaign, other phishing and malware delivery tactics have been observed, including:

1. Cloud Exploitation: Abuse of platforms like Cloudflare Pages to host phishing sites mimicking Microsoft 365 login pages.
2. Quishing Campaigns: Phishing emails with QR codes that redirect users to fake login pages.
3. File Attachment Exploits: Malicious HTML attachments embedding JavaScript to steal credentials.
4. Mobile Malware: Distribution of malicious Android apps capable of financial data theft.

Implications of the DarkGate Campaign

This attack highlights the sophistication of threat actors in leveraging legitimate tools for malicious purposes. Key risks include:

• Advanced Threat Evasion: The use of obfuscation and process injection complicates detection by traditional antivirus solutions.
• Cross-Platform Risk: DarkGate’s modular design enables its functionality across diverse environments, posing risks to Windows, macOS, and Linux systems.
• Organizational Exposure: The compromise of a single endpoint can serve as a gateway for further network exploitation, endangering sensitive organizational data.

Recommendations for Mitigation

1. Enable Advanced Threat Detection: Deploy endpoint detection and response (EDR) solutions to identify anomalous behavior like process injection and dynamic command loading.
2. Restrict Remote Access Tools: Limit the use of tools like AnyDesk to approved use cases and enforce strict monitoring.
3. Use Email Filtering and Monitoring: Implement AI-driven email filtering systems to detect and block email bombardment campaigns.
4. Enhance Endpoint Security: Regularly update and patch operating systems and applications to mitigate vulnerabilities.
5. Educate Employees: Conduct training sessions to help employees recognize and avoid phishing and social engineering tactics.
6. Implement Network Segmentation: Limit the spread of malware within an organization by segmenting high-value assets.

Conclusion

Using Microsoft Teams and AnyDesk to spread DarkGate malware shows the continuous growth of the hackers’ level. The campaign highlights how organizations have to start implementing adequate levels of security preparedness to threats, including, Threat Identification, Training employees, and Rights to Access.

The DarkGate malware is a perfect example of how these attacks have developed into MaaS offerings, meaning that the barrier to launch highly complex attacks is only decreasing, which proves once again why a layered defense approach is crucial. Both awareness and flexibility are still the key issues in addressing the constantly evolving threat in cyberspace.

Reference:

• https://thehackernews.com/2024/12/attackers-exploit-microsoft-teams-and.html
• https://socprime.com/blog/darkgate-malware-detection/

Introduction

The Government of India has initiated a cybercrime crackdown that has resulted in the blocking of 781,000 SIM cards and 208,469 IMEI (International Mobile Equipment Identity) numbers that are associated with digital fraud as of February 2025. This data was released as a written response by the Union Minister of State for Home Affairs, Bandi Sanjay Kumar, with respect to a query presented in the Lok Sabha. A significant jump from the 669,000 SIM cards blocked in the past year, efforts aimed at combating digital fraud are in full swing, considering the increasing cases. The Indian Cyber Crime Coordination Centre (I4C) is proactively blocking other platform accounts found suspicious, such as WhatsApp Accounts (83,668) and Skype IDs (3,962) on its part, aiding in eliminating identified threat actors.

Increasing Digital Fraud And The Current Combative Measures

According to the data tabled by the Ministry of Finance in the Rajya Sabha, the first 10 months of the Financial year 2024-2025 have recorded around 2.4 million incidents covering an amount of Rs. 4,245 crore involving cases of digital Financial Fraud cases. Apart from the evident financial loss, such incidents also take an emotional toll as people are targeted regardless of their background and age, leaving everyone equally vulnerable. To address this growing problem, various government departments have dedicated measures to combat and reduce such incidents. Some of the notable initiatives/steps are as follows:

• The Citizen Financial Cyber Fraud Reporting and Management System- This includes reporting Cybercrimes through the nationwide toll-free (1930) number and registration on the National Cyber Crime Reporting Portal. On being a victim of digital fraud, one can call the toll-free number, describing details of the incident, which would further help in the investigation. After reporting the incident, the complainant receives a generated login ID/acknowledgement number that they can use for further reference.
• International Incoming Spoofed Calls Prevention System- This is a mechanism developed to counter fraudulent calls that appear to originate from within India but are actually made from international locations. This system prevents the misuse of the Calling Line Identity (CLI), which is manipulated to deceive recipients in order to carry out financial crimes like digital arrests, among other things. Coordinating with the Department of Telecommunication (DoT), private telecommunication service providers (TSPs) are being encouraged to check with their ILD (International Long-Distance) network as a measure. Airtel has recently started categorising such numbers as International numbers on their part.
• Chakshu Facility at Sanchar Saathi platform- A citizen-centric initiative, created by the Department of Telecommunications, to empower mobile subscribers. It focuses on reporting unsolicited commercial communication (spam messages) and reporting suspected fraudulent communication. (https://sancharsaathi.gov.in/). 
• Aadhaar-based verification of SIM cards- A directive issued by the Prime Minister's Office to the Department of Telecommunications mandates an Aadhaar-based biometric verification for the issuance of new SIM cards. This has been done so in an effort to prevent fraud and cybercrime through mobile connections obtained using fake documents. Legal action against non-compliant retailers in the form of FIRs is also being taken.

On the part of the public, awareness of the following steps could encourage them on how to deal with such situations:

• Awareness regarding types of crimes and the tell-tale signs of the modus operandi of a criminal: A general awareness and a cautionary approach to how such crimes take place could help better prepare and respond to such malicious scams. Some important signs on the part of the offender include pressuring the victim into immediate action, insistence on video calls, and the threat of arrest in case of non-compliance. It is also important to note that no official authority, in any legal capacity, allows for enabling a digital/online arrest.
• Knowing the support channels: Awareness regarding reporting mechanisms and cyber safety hygiene tips can help in building cyber resilience amongst netizens. 

Conclusion

As cybercrooks continue to find new ways of duping people of their hard-earned money, both government and netizens must make efforts to combat such crimes and increase awareness on both ends (systematic and public). Increasing developments in AI, deepfakes, and other technology often render the public inept at assessing the veracity of the source, making them susceptible to such crime. A cautionary yet proactive approach is need of the hour. 

References

• https://mobileidworld.com/india-blocks-781000-sim-cards-in-major-cybercrime-crackdown/
• https://www.storyboard18.com/how-it-works/over-83k-whatsapp-accounts-used-for-digital-arrest-blocked-home-ministry-60292.htm
• https://www.business-standard.com/finance/news/digital-financial-frauds-touch-rs-4-245-crore-in-the-apr-jan-period-of-fy25-125032001214_1.html
• https://www.business-standard.com/india-news/govt-blocked-781k-sims-3k-skype-ids-83k-whatsapp-accounts-till-feb-125032500965_1.html
• https://pib.gov.in/PressReleasePage.aspx?PRID=2042130
• https://mobileidworld.com/india-mandates-aadhaar-biometric-verification-for-new-sim-cards-to-combat-fraud/ 
• https://pib.gov.in/PressReleaseIframePage.aspx?PRID=2067113 

‍