#FactCheck-Protest Video from Nagrota Falsely Linked to Opposition Against Indian Army
Executive Summary
A video is being widely circulated on social media by Pakistani propaganda-linked users, showing a group of people protesting on a road. It is being claimed that protesters in Jammu & Kashmir stopped Indian Army personnel from entering Nagrota, indicating growing public opposition against the forces. Research by CyberPeace Research Wing found that the claim is misleading. The viral video is unrelated to any protest against the Indian Army.
Claim
A user posted the video on X, claiming: “The days of Indian military occupation are numbered; people of Jammu & Kashmir have risen against India. Protesters stopped the Indian Army from entering Nagrota.”
- https://x.com/Stealthfalconer/status/2050301106623045758?s=20
Fact Check
During the research, the CyberPeace Research Wing team found no evidence of any such incident where civilians blocked or opposed the Indian Army in Nagrota. Further probe led to a post by an X user “Defence News Of INDIA,” which contained the full version of the viral video. The accompanying information clarified that the protest took place in Dansal’s Badsu Panchayat area of Nagrota and was led by BJP MLA Devayani Rana.
The protest was organized against the Public Health Engineering (PHE) Department over severe water shortage issues in the region. Locals, along with the MLA, staged a sit-in to highlight the lack of water supply.
We also found multiple media reports, including from KBC News – Kashmir and Jammu Links News, confirming that Devayani Rana led a road blockade protest in her constituency over water scarcity and accused the Jal Shakti Department of negligence and administrative failure. Additionally, videos of the same protest were available on social media platforms, including live streams shared from Devayani Rana’s official pages.
Conclusion
Our research confirms that the viral claim is false and misleading. The video does not show any protest against the Indian Army. It is actually from a demonstration led by Devayani Rana and local residents over water shortage issues in Nagrota.
Related Blogs
Introduction
The unprecedented cyber espionage attempt on the Indian Air Force has shocked the military fraternity in the age of the internet where innovation is vital to national security. The attackers have shown a high degree of expertise in their techniques, using a variant of the infamous Go Stealer and current military acquisition pronouncements as a cover to obtain sensitive information belonging to the Indian Air Force. In this recent cyber espionage revelation, the Indian Air Force faces a sophisticated attack leveraging the infamous Go Stealer malware. The timing, coinciding with the Su-30 MKI fighter jets' procurement announcement, raises serious questions about possible national security espionage actions.
A sophisticated attack using the Go Stealer malware exploits defense procurement details, notably the approval of 12 Su-30 MKI fighter jets. Attackers employ a cunningly named ZIP file, "SU-30_Aircraft_Procurement," distributed through an anonymous platform, Oshi, taking advantage of heightened tension surrounding defense procurement.
Advanced Go Stealer Variant:
The malware, coded in Go language, introduces enhancements, including expanded browser targeting and a unique data exfiltration method using Slack, showcasing a higher level of sophistication.
Strategic Targeting of Indian Air Force Professionals:
The attack strategically focuses on extracting login credentials and cookies from specific browsers, revealing the threat actor's intent to gather precise and sensitive information.
Timing Raises Espionage Concerns:
The cyber attack coincides with the Indian Government's Su-30 MKI fighter jets procurement announcement, raising suspicions of targeted attacks or espionage activities.
The Deceitful ZIP ArchiveSU-30 Aircraft Acquisition
The cyberattack materialised as a sequence of painstakingly planned actions. Using the cleverly disguised ZIP file "SU-30_Aircraft_Procurement," the perpetrators took benefit of the authorisation of 12 Su-30 MKI fighter jets by the Indian Defense Ministry in September 2023. Distributed via the anonymous file storage network Oshi, the fraudulent file most certainly made its way around via spam emails or other forms of correspondence.
The Spread of Infection and Go Stealer Payload:
The infiltration procedure progressed through a ZIP file to an ISO file, then to a.lnk file, which finally resulted in the Go Stealer payload being released. This Go Stealer version, written in the programming language Go, adds sophisticated capabilities, such as a wider range of browsing focussed on and a cutting-edge technique for collecting information using the popular chat app Slack.
Superior Characteristics of the Go Stealer Version
Different from its GitHub equivalent, this Go Stealer version exhibits a higher degree of complexity. It creates a log file in the machine owned by the victim when it is executed and makes use of GoLang utilities like GoReSym for in-depth investigation. The malware focuses on cookies and usernames and passwords from web browsers, with a particular emphasis on Edge, Brave, and Google Chrome.
This kind is unique in that it is more sophisticated. Its deployment's cyber enemies have honed its strengths, increasing its potency and detection resistance. Using GoLang tools like GoReSym for comprehensive evaluation demonstrates the threat actors' careful planning and calculated technique.
Go Stealer: Evolution of Threat
The Go Stealer first appeared as a free software project on GitHub and quickly became well-known for its capacity to stealthily obtain private data from consumers who aren't paying attention. Its effectiveness and stealthy design rapidly attracted the attention of cyber attackers looking for a sophisticated tool for clandestine data exfiltration. It was written in the Go programming language.
Several cutting-edge characteristics distinguish the Go Stealer from other conventional data thieves. From the beginning, it showed a strong emphasis on browser focusing on, seeking to obtain passwords and login information from particular websites including Edge, Brave, and Google Chrome.The malware's initial iteration was nurtured on the GitHub database, which has the Go Stealer initial edition. Threat actors have improved and altered the code to serve their evil goals, even if the basic structure is freely accessible.
The Go Stealer version that has been discovered as the cause of the current internet spying by the Indian Air Force is not limited to its GitHub roots. It adds features that make it more dangerous, like a wider range of browsers that may be targeted and a brand-new way to exfiltrate data via Slack, a popular messaging app.
Secret Communications and Information Expulsion
This variation is distinguished by its deliberate usage of the Slack API for secret chats. Slack was chosen because it is widely used in company networks and allows harmful activity to blend in with normal business traffic. The purpose of the function "main_Vulpx" is specifically to upload compromised information to the attacker's Slack route, allowing for covert data theft and communication.
The Time and Strategic Objective
There are worries about targeted assaults or espionage activities due to the precise moment of the cyberattack, which coincides with the Indian government's declaration of its acquisition of Su-30 MKI fighter fighters. The deliberate emphasis on gathering cookies and login passwords from web browsers highlights the threat actor's goal of obtaining accurate and private data from Indian Air Force personnel.
Using Caution: Preventing Possible Cyber Espionage
- Alertness Against Misleading Techniques: Current events highlight the necessity of being on the lookout for files that appear harmless but actually have dangerous intent. The Su-30 Acquisition ZIP file is a stark illustration of how these kinds of data might be included in larger-scale cyberespionage campaigns.
- Potentially Wider Impact: Cybercriminals frequently plan coordinated operations to target not just individuals but potentially many users and government officials. Compromised files increase the likelihood of a serious cyber-attack by opening the door for larger attack vectors.
- Important Position in National Security: Recognize the crucial role people play in the backdrop of national security in the age of digitalisation. Organised assaults carry the risk of jeopardising vital systems and compromising private data.
- Establish Strict Download Guidelines: Implement a strict rule requiring file downloads to only come from reputable and confirmed providers. Be sceptical, particularly when you come across unusual files, and make sure the sender is legitimate before downloading any attachments.
- Literacy among Government Employees: Acknowledge that government employees are prime targets as they have possession of private data. Enable people by providing them with extensive cybersecurity training and awareness that will increase their cognition and fortitude.
Conclusion
Indian Air Force cyber surveillance attack highlights how sophisticated online dangers have become in the digital era. Threat actors' deliberate and focused approach is demonstrated by the deceptive usage of a ZIP archive that is camouflaged and paired with a sophisticated instance of the Go Stealer virus. An additional level of complication is introduced by integrating Slack for covert communication. Increased awareness, strict installation guidelines, and thorough cybersecurity education for government employees are necessary to reduce these threats. In the digital age, protecting national security necessitates ongoing adaptation as well as safeguards toward ever-more potent and cunning cyber threats.
References
- https://www.overtoperator.com/p/indianairforcemalwaretargetpotential
- https://cyberunfolded.in/blog/indian-air-force-targeted-in-sophisticated-cyber-attack-with-su-30-procurement-zip-file#go-stealer-a-closer-look-at-its-malicious-history
- https://thecyberexpress.com/cyberattack-on-the-indian-air-force/https://therecord.media/indian-air-force-infostealing-malware
Introduction
Quantum technology involves the study of matter and energy at the sub-atomic level. This technology uses superposition and entanglement to provide new capabilities in computing, cryptography and communication and solves problems at speeds not possible with classical computers. Unlike classical bits, qubits can exist in a superposition of states, representing 0, 1, or any combination of these states simultaneously. The Union Cabinet approved the National Quantum Mission on 19 April 2023, with a budget allocation of Rs 6000 Crore. The mission will seed, nourish, and scale up scientific and industrial R&D in the domain of quantum technology so that India emerges as one of the leaders in developing quantum technologies and their applications.
The Union Minister for Science and Technology and Minister of Earth Sciences, Dr. Jitendra Singh announced the selection of 8 start-ups for support under India’s National Quantum Mission and the National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS). The selected start-ups represent diverse quantum tech domains and were chosen via a rigorous evaluation process. These startups are poised to be critical enablers in translating quantum research into practical applications. This start-up selection aligns with India’s broader vision for technological self-reliance and innovation by 2047.
Policy Landscape and Vision
The National Quantum Mission’s main goal is to develop intermediate-scale quantum computers with 50-1000 physical qubits in 8 years, across diverse platforms such as superconducting and photonic technology. The mission deliverables include the development of satellite-based secure quantum communications between ground stations over a range of 2000 km within India, long-distance secure quantum communications with other countries, inter-city quantum key distribution over 2000 km, and multi-node quantum networks with quantum memories.
The National Mission on Interdisciplinary Cyber-Physical Systems aims to promote translational research in Cyber-Physical Systems and associated technologies and prototypes and demonstrates applications for national priorities. The other expectations are enhancing the top-of-the-line research base, human resource development and skill sets in these emerging areas. These missions align with India’s broader ideals such as the Digital India and Make in India campaigns to strengthen India’s technological ecosystem.
Selected Startups and Their Innovations
The startups selected reflect alignment with India’s National Quantum Mission, oriented towards fostering cutting-edge research and innovation and have industrial applications aiming at placing India as the global leader in quantum technology. The selections are:
- QNu Labs (Bengaluru): is advancing quantum communication by developing end-to-end quantum-safe heterogeneous networks.
- QPiAI India Pvt. Ltd. (Bengaluru): is building a superconducting quantum computer.
- Dimira Technologies Pvt. Ltd. (IIT Mumbai): is creating indigenous cryogenic cables, essential for quantum computing.
- Prenishq Pvt. Ltd. (IIT Delhi): developing precision diode-laser systems.
- QuPrayog Pvt. Ltd. (Pune): is working on creating optical atomic clocks and related technologies.
- Quanastra Pvt. Ltd. (Delhi): is developing advanced cryogenics and superconducting detectors.
- Pristine Diamonds Pvt. Ltd. (Ahmedabad): is creating diamond materials for quantum sensing.
- Quan2D Technologies Pvt. Ltd. (Bengaluru): is making advancements in superconducting Nanowire Single-photon Detectors.
References
Executive Summary
A video is being shared on social media with the claim that a Dalit woman was raped inside the Ram Temple in Ayodhya. In the video, two women can be seen crying, while some people around them appear to be consoling them. CyberPeace Research Wing’s research found the viral claim to be false. Our research found that the viral video has been created by combining two separate clips. In the first part of the video, a woman can be seen staging a protest at Buddha Park in Haldwani and raising issues related to her in-laws. The second part shows a girl expressing her anger. Our research found that this clip has been available on the internet since December 27, 2025. Neither of the two videos is related to the alleged rape of a Dalit woman inside the Ram Temple in Ayodhya.
Claim:
A Facebook user shared the viral video on September 21, 2026, with the caption, “Dalit woman raped inside the Ram Temple.”The post link, archive link and screenshot are provided below.
https://www.facebook.com/watch/?v=1420442086956519
Fact Check
To verify the authenticity of the viral image, we conducted a Google search using relevant keywords. However, we did not find any credible media report related to the viral image during the search. To verify the claim, we conducted a reverse image search of the keyframes from the video. During the search, we found the same video on the Facebook page of Punjab Kesari - Uttarakhand, where it was published on March 6, 2026. According to the post, the woman staged a protest at Buddha Park in Haldwani and raised issues related to her in-laws. The link and screenshot of the relevant post are provided below.
https://www.facebook.com/watch/?v=897776589732940
Meanwhile, we found the second part of the viral video on LinkedIn, where the video was published on December 27, 2025.
Our research makes it clear that two old and unrelated videos are being shared with a misleading claim linking them to the Ram Temple in Ayodhya. The videos have no connection with the alleged incident on the temple premises, and based on the available evidence, there is no confirmation of any such incident taking place at the Ram Temple. Our research found that the viral video was created by combining two separate clips. In the first part of the video, a woman can be seen staging a protest at Buddha Park in Haldwani and raising issues related to her in-laws. In the second part, a girl can be seen expressing her anger. Our research found that this clip has been available on the internet since December 27, 2025. Neither of the two videos is related to the alleged rape of a Dalit woman inside the Ram Temple in Ayodhya.
