#FactCheck- Viral ‘Army Jump Accident’ Video Is AI-Generated

Executive Summary:

In late 2024 an Indian healthcare provider experienced a severe cybersecurity attack that demonstrated how powerful AI ransomware is. This blog discusses the background to the attack, how it took place and the effects it caused (both medical and financial), how organisations reacted, and the final result of it all, stressing on possible dangers in the healthcare industry with a lack of sufficiently adequate cybersecurity measures in place. The incident also interrupted the normal functioning of business and explained the possible economic and image losses from cyber threats. Other technical results of the study also provide more evidence and analysis of the advanced AI malware and best practices for defending against them. 

1. Introduction

The integration of artificial intelligence (AI) in cybersecurity has revolutionised both defence mechanisms and the strategies employed by cybercriminals. AI-powered attacks, particularly ransomware, have become increasingly sophisticated, posing significant threats to various sectors, including healthcare. This report delves into a case study of an AI-powered ransomware attack on a prominent Indian healthcare provider in 2024, analysing the attack's execution, impact, and the subsequent response, along with key technical findings.

2. Background 

 In late 2024, a leading healthcare organisation in India which is involved in the research and development of AI techniques fell prey to a ransomware attack that was AI driven to get the most out of it. With many businesses today relying on data especially in the healthcare industry that requires real-time operations, health care has become the favourite of cyber criminals. AI aided attackers were able to cause far more detailed and damaging attack that severely affected the operation of the provider whilst jeopardising the safety of the patient information.  

 3. Attack Execution 

The attack began with the launch of a phishing email designed to target a hospital administrator. They received an email with an infected attachment which when clicked in some cases injected the AI enabled ransomware into the hospitals network. AI incorporated ransomware was not as blasé as traditional ransomware, which sends copies to anyone, this studied the hospital’s IT network. First, it focused and targeted important systems which involved implementation of encryption such as the electronic health records and the billing departments. 

The fact that the malware had an AI feature allowed it to learn and adjust its way of propagation in the network, and prioritise the encryption of most valuable data. This accuracy did not only increase the possibility of the potential ransom demand but also it allowed reducing the risks of the possibility of early discovery. 

 4. Impact 

•  The consequences of the attack were immediate and severe: The consequences of the attack were immediate and severe.
•  Operational Disruption: The centralization of important systems made the hospital cease its functionality through the acts of encrypting the respective components. Operations such as surgeries, routine medical procedures and admitting of patients were slowed or in some cases referred to other hospitals. 
•  Data Security: Electronic patient records and associated billing data became off-limit because of the vulnerability of patient confidentiality. The danger of data loss was on the verge of becoming permanent, much to the concern of both the healthcare provider and its patients. 
•  Financial Loss: The attackers asked for 100 crore Indian rupees (approximately 12 USD million) for the decryption key. Despite the hospital not paying for it, there were certain losses that include the operational loss due to the server being down, loss incurred by the patients who were affected in one way or the other, loss incurred in responding to such an incident and the loss due to bad reputation. 

5. Response

As soon as the hotel’s management was informed about the presence of ransomware, its IT department joined forces with cybersecurity professionals and local police. The team decided not to pay the ransom and instead recover the systems from backup. Despite the fact that this was an ethically and strategically correct decision, it was not without some challenges. Reconstruction was gradual, and certain elements of the patients’ records were permanently erased. 

 In order to avoid such attacks in the future, the healthcare provider put into force several organisational and technical actions such as network isolation and increase of cybersecurity measures. Even so, the attack revealed serious breaches in the provider’s IT systems security measures and protocols. 

6. Outcome

The attack had far-reaching consequences:

• Financial Impact: A healthcare provider suffers a lot of crashes in its reckoning due to substantial service disruption as well as bolstering cybersecurity and compensating patients. 
•  Reputational Damage: The leakage of the data had a potential of causing a complete loss of confidence from patients and the public this affecting the reputation of the provider. This, of course, had an effect on patient care, and ultimately resulted in long-term effects on revenue as patients were retained. 
•  Industry Awareness: The breakthrough fed discussions across the country on how to improve cybersecurity provisions in the healthcare industry. It woke up the other care providers to review and improve their cyber defence status. 

7. Technical Findings

The AI-powered ransomware attack on the healthcare provider revealed several technical vulnerabilities and provided insights into the sophisticated mechanisms employed by the attackers. These findings highlight the evolving threat landscape and the importance of advanced cybersecurity measures.

7.1 Phishing Vector and Initial Penetration

• Sophisticated Phishing Tactics: The phishing email was crafted with precision, utilising AI to mimic the communication style of trusted contacts within the organisation. The email bypassed standard email filters, indicating a high level of customization and adaptation, likely due to AI-driven analysis of previous successful phishing attempts.
• Exploitation of Human Error: The phishing email targeted an administrative user with access to critical systems, exploiting the lack of stringent access controls and user awareness. The successful penetration into the network highlighted the need for multi-factor authentication (MFA) and continuous training on identifying phishing attempts.

7.2 AI-Driven Malware Behavior

• Dynamic Network Mapping: Once inside the network, the AI-powered malware executed a sophisticated mapping of the hospital's IT infrastructure. Using machine learning algorithms, the malware identified the most critical systems—such as Electronic Health Records (EHR) and the billing system—prioritising them for encryption. This dynamic mapping capability allowed the malware to maximise damage while minimising its footprint, delaying detection.
• Adaptive Encryption Techniques: The malware employed adaptive encryption techniques, adjusting its encryption strategy based on the system's response. For instance, if it detected attempts to isolate the network or initiate backup protocols, it accelerated the encryption process or targeted backup systems directly, demonstrating an ability to anticipate and counteract defensive measures.
• Evasive Tactics: The ransomware utilised advanced evasion tactics, such as polymorphic code and anti-forensic features, to avoid detection by traditional antivirus software and security monitoring tools. The AI component allowed the malware to alter its code and behaviour in real time, making signature-based detection methods ineffective.

7.3 Vulnerability Exploitation

• Weaknesses in Network Segmentation: The hospital’s network was insufficiently segmented, allowing the ransomware to spread rapidly across various departments. The malware exploited this lack of segmentation to access critical systems that should have been isolated from each other, indicating the need for stronger network architecture and micro-segmentation.
• Inadequate Patch Management: The attackers exploited unpatched vulnerabilities in the hospital’s IT infrastructure, particularly within outdated software used for managing patient records and billing. The failure to apply timely patches allowed the ransomware to penetrate and escalate privileges within the network, underlining the importance of rigorous patch management policies.

7.4 Data Recovery and Backup Failures

• Inaccessible Backups: The malware specifically targeted backup servers, encrypting them alongside primary systems. This revealed weaknesses in the backup strategy, including the lack of offline or immutable backups that could have been used for recovery. The healthcare provider’s reliance on connected backups left them vulnerable to such targeted attacks.
• Slow Recovery Process: The restoration of systems from backups was hindered by the sheer volume of encrypted data and the complexity of the hospital’s IT environment. The investigation found that the backups were not regularly tested for integrity and completeness, resulting in partial data loss and extended downtime during recovery.

7.5 Incident Response and Containment

• Delayed Detection and Response: The initial response was delayed due to the sophisticated nature of the attack, with traditional security measures failing to identify the ransomware until significant damage had occurred. The AI-powered malware’s ability to adapt and camouflage its activities contributed to this delay, highlighting the need for AI-enhanced detection and response tools.
• Forensic Analysis Challenges: The anti-forensic capabilities of the malware, including log wiping and data obfuscation, complicated the post-incident forensic analysis. Investigators had to rely on advanced techniques, such as memory forensics and machine learning-based anomaly detection, to trace the malware’s activities and identify the attack vector.

8. Recommendations Based on Technical Findings

To prevent similar incidents, the following measures are recommended:

1. AI-Powered Threat Detection: Implement AI-driven threat detection systems capable of identifying and responding to AI-powered attacks in real time. These systems should include behavioural analysis, anomaly detection, and machine learning models trained on diverse datasets.
2. Enhanced Backup Strategies: Develop a more resilient backup strategy that includes offline, air-gapped, or immutable backups. Regularly test backup systems to ensure they can be restored quickly and effectively in the event of a ransomware attack.
3. Strengthened Network Segmentation: Re-architect the network with robust segmentation and micro-segmentation to limit the spread of malware. Critical systems should be isolated, and access should be tightly controlled and monitored.
4. Regular Vulnerability Assessments: Conduct frequent vulnerability assessments and patch management audits to ensure all systems are up to date. Implement automated patch management tools where possible to reduce the window of exposure to known vulnerabilities.
5. Advanced Phishing Defences: Deploy AI-powered anti-phishing tools that can detect and block sophisticated phishing attempts. Train staff regularly on the latest phishing tactics, including how to recognize AI-generated phishing emails.

9. Conclusion

The AI empowered ransomware attack on the Indian healthcare provider in 2024 makes it clear that the threat of advanced cyber attacks has grown in the healthcare facilities. Sophisticated technical brief outlines the steps used by hackers hence underlining the importance of ongoing active and strong security. This event is a stark message to all about the importance of not only remaining alert and implementing strong investments in cybersecurity but also embarking on the formulation of measures on how best to counter such incidents with limited harm. AI is now being used by cybercriminals to increase the effectiveness of the attacks they make and it is now high time all healthcare organisations ensure that their crucial systems and data are well protected from such attacks.

‍

In recent months, conversations around the possible shortage of liquefied petroleum gas (LPG), a basic cooking fuel in Indian households, have quietly resurfaced across the country. From whispers in local markets to viral messages circulating on social media, concerns about LPG availability began to take hold in the public imagination. Though the immediacy of the situation has since faded, its echoes remain, reminding us how quickly uncertainty can spread. Like a ripple across still water, a single rumour can travel far, gathering force as it moves and blurring the line between perception and reality. 

Against this backdrop, in April 2026, reports began circulating about a potential LPG shortage. The Union Government moved quickly to counter what it identified as misinformation, emphasising that supply remained stable and urging citizens not to engage in panic buying.  A noticeable disconnect emerged between official communication and public perception. Across different regions, signs of anxiety-driven behaviour became evident. Instances of panic buying and hoarding increased, law enforcement agencies conducted raids to address such actions, and opportunistic thefts were reported, often exploiting widespread concern. These incidents highlight how misinformation, even when addressed promptly, can continue to shape public behaviour. 

It is worth noting that rising prices also played a role in shaping public response, as increases in LPG rates contributed to a sense of urgency among consumers. Therefore, the surge in panic buying cannot be attributed solely to misinformation, but rather to a combination of economic pressures and perceived scarcity.

‍

Misinformation Ecosystem - From Rumours to Behaviour
‍

The spread of misinformation is occurring at an unprecedented pace and is, in large part, driven by the viral nature of social media. Digital platforms not only enable the rapid dissemination of information but also allow it to be amplified in ways that would not be possible through traditional media outlets. Often, the drive for virality outweighs any concern for accuracy, meaning that many individuals who spread misinformation are motivated more by the pursuit of attention than by any ideological agenda. Recent arrests of individuals involved in spreading misinformation about LPG and petrol shortages, much of which went viral, suggest that misinformation today is frequently driven by the desire for visibility rather than ideological motives. The information being circulated has largely followed a similar pattern, focusing on fears of an LPG shortage, expectations of price increases, and concerns about supply disruptions. Even though this information has not been verified, it has triggered behavioural responses among individuals. In several areas, including parts of Uttar Pradesh and Goa, the spread of misinformation through social media has led to panic buying, despite official assurances that there would be sufficient LPG supply to meet demand. 

‍

The impact of panic buying, and its associated misinformation, has already been seen in multiple sectors; these increased demands have placed pressure on the distribution network, leading to disruptions in access, as well as being out of stock of certain products. In many cases, commercial users of products (especially restaurants) have experienced significant disruption, threatening their continued operations, and industry representatives have alerted others about the inconsistent supply of commercial cylinders; likewise, consumers (households) are beginning to switch to alternative products (e.g., induction cooking) as a reflection of the anticipatory mindset to address the uncertainty created through perceptions of Product Scarcity.
‍

‍

State Response: Managing Misinformation or Behaviour?
‍

‍

The government has taken a variety of approaches, from advisories and enforcement actions to communicating with citizens indirectly. For example, State Governments have been directed to combat misinformation, monitor supply chains and take action against hoarding and black market activity. There has been a significant increase in the level of large- scale enforcement activity, with over 3,700 raids carried out to crack down on hoarding and black marketing related to LPG, in addition to confiscating cylinders and issuing penalties to those who break the law. In addition, the authorities have also focused on maintaining regular communication with the public in order to reassure them about the supply of LPG and fuel stability.

‍

Geopolitical Context: Why Rumours Are Believable
‍

Understanding today’s panic requires an understanding of the global environment: i.e., due to the ongoing conflict in West Asia, the energy markets are unstable, and energy supply is uncertain not only in West Asia but across a large part of the world. Even if domestic supply remains stable, public perception is affected by global instability. A clear example of this can be seen in neighbouring countries to India; Pakistan has seen significant increases in the cost of fuel, implemented measures such as reducing the number of days individuals work each week, and has created public support mechanisms; Bangladesh has imposed restrictions on the use of energy, has shortened the number of hours individuals can operate businesses each day, and has restricted the total amount of energy used; Sri Lanka has begun to ration fuel, and to increase the price of petrol; and Nepal has reduced the numbers of days individuals may work each week, and has adjusted supply.

‍

All of these examples are not isolated instances, but are markers of a common regional environment. As we live in a global community that is connected in many ways, these developments will quickly affect public expectations everywhere. Therefore, for consumers in India, seeing evidence of rationing of fuel and shortages of fuel in neighbouring countries increases their belief that these types of problems could occur in their country.

‍

Critical Perspective: Between Panic and Precaution
‍

The LPG incident has brought about questions surrounding the nature of misinformation in terms of its definition & regulation. One of the main concerns is whether or not "misinformation" is being cast too widely. To be sure, false claims need to be addressed; however, not everything that is responded to publicly is based on untrue facts, as many times public responses are based on perceived risk via global and/or local incidents that occur. Perhaps the greatest challenge is the difficulty in differentiating precaution and panic. People’s memories of the COVID-19 pandemic are fresh in their minds and will serve to influence their behaviours moving onward, in that many people are stockpiling or preparing for uncertainty not out of irrational fear, but as an anticipatory response to their prior experiences.

‍

Conclusion
‍

The Indian LPG "crisis" is not so much a problem with actual supply chain breakdown as it is a result of how information and behaviour are connected through perception. This cohabitating environment of panic buying, law enforcement, and government assurance demonstrates an evident disconnect and gap between how governments present a narrative and how the public responds. While there is some role of misinformation within this discourse, the misinformation itself extends beyond any or all false claims about LPG supply and operates within a greater ecosystem of global uncertainty and personal experience.  As such, and because of this, perception becomes an incredibly strong force in itself that produces true economic consequences.

‍

Reference
‍

1. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2248640&utm_source&reg=3&lang=2 
2. https://www.pmindia.gov.in/en/news_updates/pm-addresses-the-lok-sabha-on-the-ongoing-conflict-in-west-asia/ 
3. https://www.ndtv.com/delhi-news/iran-war-middle-east-conflict-why-the-lpg-crisis-is-forcing-migrants-to-quietly-leave-delhi-11313629 
4. https://timesofindia.indiatimes.com/city/bareilly/thieves-steal-108-lpg-cylinders-from-godown-in-up/articleshow/130035518.cms 
5. https://indianexpress.com/article/india/arrested-rumours-lpg-petrol-shortage-police-chasing-views-10614193/ 
6. https://www.hindustantimes.com/cities/lucknow-news/social-media-rumours-fuel-panic-buying-in-some-up-districts-situation-normal-in-lucknow-101774465353107.html 
7. https://timesofindia.indiatimes.com/city/goa/fear-of-shortage-price-rise-fuels-panic-buying-across-goa/articleshow/129810144.cms 
8. https://www.news18.com/cities/new-delhi-news/online-rumours-offline-rush-panic-buying-sweeps-petrol-pumps-across-cities-whats-the-truth-ws-ln-9995684.html 
9. https://m.economictimes.com/news/india/3700-raids-conducted-across-country-to-wipe-out-lpg-black-marketing-says-centre/articleshow/130025232.cms 
10. https://www.reuters.com/business/energy/induction-stoves-fly-off-shelves-india-gas-shortage-fears-spark-panic-buying-2026-03-12/ 
11. https://www.ndtv.com/india-news/restaurant-body-warns-of-closures-over-commercial-lpg-supply-concerns-writes-to-minister-11194418 
12. https://www.freepressjournal.in/mumbai/fpj-dialogue-we-are-getting-only-1-cylinder-instead-of-10-says-ahar-president-vijay-shetty-on-mumbai-lpg-crisis 
13. https://www.hindustantimes.com/world-news/fuel-cuts-wfh-and-more-how-indias-neighbours-are-dealing-with-global-energy-crisis-triggered-by-us-iran-war-101775397199941.html 
14. https://www.abc.net.au/news/2026-03-30/four-step-fuel-supply-plan-national-cabinet-fuel-crisis/106512706 ‍
15. https://tribune.net.ph/2026/04/07/philippines-scrambles-as-regional-oil-crisis-hits

Executive Summary:

A recent claim going around on social media that a child created sand sculptures of cricket legend Mahendra Singh Dhoni, has been proven false by the CyberPeace Research Team. The team discovered that the images were actually produced using an AI tool. Evident from the unusual details like extra fingers and unnatural characteristics in the sculptures, the Research Team discerned the likelihood of artificial creation. This suspicion was further substantiated by AI detection tools. This incident underscores the need to fact-check information before posting, as misinformation can quickly go viral on social media. It is advised everyone to carefully assess content to stop the spread of false information.

Claims:

The claim is that the photographs published on social media show sand sculptures of cricketer Mahendra Singh Dhoni made by a child.

Fact Check:

Upon receiving the posts, we carefully examined the images. The collage of 4 pictures has many anomalies which are the clear sign of AI generated images.

‍

In the first image the left  hand of the sand sculpture has 6 fingers and in the word INDIA, ‘A’ is not properly aligned i.e not in the same line as other letters. In the second image, the finger of the boy is missing and the sand sculpture has 4 fingers in its front foot and has 3 legs. In the third image the slipper of the boy is not visible whereas some part of the slipper is visible, and in the fourth image the hand of the boy is not looking like a hand. These are some of the major discrepancies clearly visible in the images.

We then checked using an AI Image detection tool named ‘Hive’ image detection, Hive detected the image as 100.0% AI generated.

We then checked it in another AI image detection named ContentAtScale AI image detection, and it found to be 98% AI generated.

‍

From this we concluded that the Image is AI generated and has no connection with the claim made in the viral social media posts. We have also previously debunked AI Generated artwork of sand sculpture of Indian Cricketer Virat Kohli which had the same types of anomalies as those seen in this case.

Conclusion:

Taking into consideration the distortions spotted in the images and the result of AI detection tools, it can be concluded that the claim of the pictures representing the child's sand sculptures of cricketer Mahendra Singh Dhoni is false. The pictures are created with Artificial Intelligence. It is important to check and authenticate the content before posting it to social media websites.

• Claim: The frame of pictures shared on social media contains child's sand sculptures of cricket player Mahendra Singh Dhoni.
• Claimed on: X (formerly known as Twitter), Instagram, Facebook, YouTube
• Fact Check: Fake & Misleading