#FactCheck- Old Ladakh Protest Video Falsely Shared as Violence Following Sonam Wangchuk’s Arrest

Overview:

A recent addition to the  list of cybercrime  is SharpRhino, a RAT (Remote Access Trojan) actively used by Hunters International ransomware group. SharpRhino is highly developed and penetrates into the network mask of IT specialists, primarily due to the belief in the tools’ legitimacy. Going under the genuine software installer, SharpRhino started functioning in mid-June 2024. However, Quorum Cyber discovered it in early August 2024 while investigating ransomware.

About Hunters International Group:

Hunters International emerged as one of the most notorious groups focused on ransomware attacks, having compromised over 134 targets worldwide in the first seven months of 2024. It is believed that the group is the rebranding of Hive ransomware group that was previously active, and there are considerable similarities in the code. Its focus on IT employees in particular demonstrates the fact that they move tactically in gaining access to the organizations’ networks.

Modus Operandi:

1. Typosquatting Technique 

SharpRhino is mainly distributed by a domain that looks like the genuine Angry IP Scanner, which is a popular network discovery tool. The malware installer, labeled as ipscan-3.9.1-setup. It is a 32-bit Nullsoft installer which embeds a password protected 7z archive in it. 

2. Installation Process 

• Execution of Installer: When the victim downloads and executes the installer and changes the windows registry in order to attain persistence. This is done by generating a registry entry that starts a harmful file, Microsoft. AnyKey. exe, are fakes originating from fake versions of true legitimate Microsoft Visual Studio tools. 

• Creation of Batch File: This drops a batch file qualified as LogUpdate at the installer.bat, that runs the PowerShell scripts on the device. These scripts are to compile C# code into memory to serve as a means of making the malware covert in its operation. 

• Directory Creation: The installer establishes two directories that allow the C2 communication – C:\ProgramData\Microsoft: WindowsUpdater24 and LogUpdateWindows. 

3. Execution and Functionality: 

• Command Execution: The malware can execute PowerShell commands on the infected system, these actions may involve privilege escalation and other extended actions such as lateral movement. 

• C2 Communication: SharpRhino interacts with command and control servers located on domains from platforms such as Cloudflare. This communication is necessary for receiving commands from the attackers and for returning any data of interest to the attackers. 

• Data Exfiltration and Ransomware Deployment: Once SharpRhino has gained control, it can steal information and then proceed to encrypt it with a .locked extension. The procedure generally concludes with a ransom message, which informs users on how to purchase the decryption key. 

4. Propagation Techniques: 

Also, SharpRhino can spread through the self-copying method, this is the virus may copy itself to other computers using the network account of the victim and pretending to be trustworthy senders such as emails or network-shared files. Moreover, the victim’s machine may then proceed to propagate the malware to other systems like sharing in the company with other employees.

Indicators of Compromise (IOCs):

• LogUpdate.bat
• Wiaphoh7um.t
• ipscan-3.9.1-setup.exe
• kautix2aeX.t
• WindowsUpdate.bat

Command and Control Servers:

• cdn-server-1.xiren77418.workers.dev
• cdn-server-2.wesoc40288.workers.dev
• Angryipo.org
• Angryipsca.com

Analysis:

‍

‍

Graph:

Precautionary measures to be taken:

To mitigate the risks posed by SharpRhino and similar malware, organizations should implement the following measures:

• Implement Security Best Practices: It is important only to download software from official sites and avoid similar sites to confuse the user by changing a few letters.

• Enhance Detection Capabilities: Use technology in detection that can detect the IOCs linked to Sharp Rhino.

• Educate Employees: Educate IT people and employees on phishing scams and the requirement to check the origin of the application.

• Regular Backups: It is also important to back up important files from systems and networks in order to minimize the effects of ransomware attacks on a business.

Conclusion:

SharpRhino could be deemed as the evolution of the strategies used by organizations like Hunters International and others involved in the distribution of ransomware. SharpRhino primarily focuses on the audience of IT professionals and employs complex delivery and execution schemes, which makes it an extremely serious threat for corporate networks. To do so it is imperative that organizations have an understanding of its inner workings in order to fortify their security measures against this relatively new threat. Through the enforcement of proper security measures and constant enlightenment of organizations on the importance of cybersecurity, firms can prevent the various risks associated with SharpRhino and related malware. Be safe, be knowledgeable, and most importantly, be secure when it comes to cyber security for your investments.

Reference: 

https://cybersecuritynews.com/sharprhino-ransomware-alert/

https://cybersecsentinel.com/sharprhino-explained-key-facts-and-how-to-protect-your-data/

https://www.dataprivacyandsecurityinsider.com/2024/08/sharprhino-malware-targeting-it-professionals/

‍

On 25 September 2026, at UN Headquarters in New York, External Affairs Minister S. Jaishankar signed the United Nations Convention against Cybercrime on the sidelines of the 81st session of the UN General Assembly, calling it a step that "strengthens international cooperation for a safer digital future."

 The signature places India among the growing list of nations joining what is officially the first comprehensive global treaty dedicated to cybercrime. What Jaishankar's brief statement did not mention is that this same treaty has spent the better part of three years drawing sustained, detailed criticism from human rights organisations, technology companies, and digital rights groups, who argue it risks becoming a tool for surveillance rather than a tool against crime.

A Conversation CyberPeace Has Been Having for Years

For CyberPeace, India’s signature is not an isolated development but the latest chapter in a conversation the organisation has been following since the Convention was still being negotiated.

In December 2024, CyberPeace published its analysis of the emerging UN Convention against Cybercrime, examining its objectives, proposed offences, mechanisms for international cooperation, electronic evidence and its relationship with the Budapest Convention. The analysis also highlighted an important principle embedded in the emerging framework: that stronger cybercrime enforcement must operate alongside due process, privacy and human-rights safeguards.

That conversation continued in October 2025, when CyberPeace published The Digital Leviathan: The UN Cybercrime Treaty and the Future of Global Governance. The piece examined the Convention not merely as a cybercrime instrument, but as part of a larger evolution in global digital governance, particularly around cross-border evidence, international cooperation and the changing architecture of cyber sovereignty.

And in August 2026, CyberPeace returned to the question from the operational side in The World Is Rewriting the Rules Against Cyber-Enabled Transnational Crime. The analysis placed the Convention alongside the wider international response to transnational cyber-enabled crime, including scam networks, financial fraud and increasingly sophisticated criminal ecosystems that operate across multiple jurisdictions.

What the Convention actually is

The treaty's full, formal title is unusually descriptive for a UN instrument: the United Nations Convention against Cybercrime, Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes. The UN General Assembly adopted it unanimously on 24 December 2024, following three years of negotiation, and it opened for signature at a ceremony in Hanoi, Vietnam, in October 2025. It will remain open for signature at UN Headquarters through 31 December 2026, and comes into force ninety days after the fortieth country ratifies it.

At its core, the Convention gives signatory states a shared legal framework for two things: preventing and prosecuting offences committed through digital systems, and cooperating across borders when evidence, offenders, or victims of a crime are scattered across multiple jurisdictions, a structural problem that has long frustrated cybercrime investigations. It also includes provisions specifically addressing the recovery of criminal proceeds, adding a financial dimension that lets states cooperate not just on prosecuting offenders but on tracing and reclaiming stolen money that has moved across borders, often through mule accounts and shell transactions designed to outrun any single country's jurisdiction.

Why India signed, in its own words

Jaishankar's public reasoning was concise. Cybercrime, in the government's framing, does not respect national boundaries, and India's own cybercrime caseload, spanning cross-border financial fraud, romance scams, and organised online extortion networks often operating from outside India's borders, has repeatedly run into exactly the jurisdictional walls this Convention is designed to lower. Prof. Triveni Singh, a well known cybercrime expert and former IPS officer, put the practical case plainly: "Cybercrime does not stop at national borders. Criminals can operate from one country and target victims in another. This convention can help countries share evidence and work together faster. For India, stronger international cooperation can make it easier to investigate cross-border cyber fraud and trace stolen money." 

The part the announcement leaves out

Here is where the story gets considerably more complicated than a signing ceremony photo suggests. Since before the Convention's text was even finalised, a wide coalition of digital rights organisations, including the Electronic Frontier Foundation, Human Rights Watch, the Global Network Initiative, and Privacy International, has warned that the treaty's language is dangerously broad, and that its safeguards against misuse are considerably weaker than they need to be.

Cisco, one of the few major technology companies to comment publicly, stated the Convention does not do enough to "sufficiently protect basic human rights." UN Secretary-General António Guterres, notably, has himself urged countries to sign and ratify the Convention while simultaneously calling for its implementation to be "rooted in human rights," a somewhat unusual dual message from the very institution that produced the text, and one that implicitly acknowledges the concerns raised against it.

Where this leaves India

None of this means India's signature was unwarranted. The jurisdictional friction Prof. Triveni Singh described is real and well documented, and a shared international framework for evidence sharing genuinely could accelerate investigations that currently stall for months while agencies wait on slow, bilateral mutual legal assistance requests. India's existing domestic cybercrime coordination architecture is already substantial, spanning I4C, the National Cybercrime Reporting Portal, and newer mechanisms like the Citizen Financial Cyber Fraud Reporting and Management System and the Sahyog platform, and a global treaty that maps onto this existing infrastructure could genuinely close gaps that purely domestic tools cannot reach, particularly in cases where the perpetrator, the server, and the victim all sit in different countries, a pattern that has become close to the default in organised online financial fraud rather than the exception.

But the criticisms levelled at the Convention are not fringe objections; they come from some of the most established digital rights organisations in the world, and they focus specifically on the treaty's most powerful surveillance and cross-border cooperation provisions, the very mechanisms India will now need to operationalise domestically. Signing the Convention is also only the first procedural step; India's obligations under it will not take practical effect until the instrument is ratified domestically, a process that typically allows room for a signatory state to clarify how broadly or narrowly it intends to apply the treaty's more expansive provisions. How India chooses to implement those provisions, whether through the kind of judicial oversight and narrow, offence-specific application human rights groups have called for, or through the broader interpretation the treaty's text technically permits, will likely determine whether this Convention becomes a genuine tool against fraud and organised cybercrime, or a broader instrument whose reach eventually extends well past the digital offences it was signed to address.

References

• The420.in, "India Signs UN Cybercrime Convention to Strengthen Global Fight Against Digital Crime." ANI, "EAM Jaishankar signs UN Convention against Cybercrime on UNGA sidelines." https://aninews.in/news/world/us/eam-jaishankar-signs-un-convention-against-cybercrime-on-unga-sidelines20260926063207/
• Ministry of Cyber Affairs, "India signs UN Convention against Cybercrime at UNGA 81." https://ministryofcyberaffairs.com/news/india-signs-un-convention-against-cybercrime-at-unga-81-95b7e43b-7e29-4722-a4a7-304bca55b71c
•  Electronic Frontier Foundation, "UN Cybercrime Convention Negotiations Enter Final Phase With Troubling Surveillance Powers Still on the Table."  https://www.eff.org/deeplinks/2023/08/un-cybercrime-convention-negotiations-enter-final-phase-troubling-surveillance
• Electronic Frontier Foundation, "First Draft of UN Cybercrime Convention Drops Troubling Provisions, But Dangerous And Open-Ended Cross Border Surveillance Powers Are Still on the Table."
• https://www.eff.org/deeplinks/2023/07/first-draft-un-cybercrime-treaty-drops-troubling-provisions-dangerous-and-open
• Global Network Initiative, "GNI Calls on Member States Not to Support the UN Cybercrime Convention." https://globalnetworkinitiative.org/gni-statement-on-uncc/
• Just Security, "The UN Cybercrime Convention: Analyzing the Risks to Human Rights and Global Privacy." https://www.justsecurity.org/98738/cybercrime-convention-human-rights/
• TechRadar Pro, "UN cybercrime convention inadequate, says Human Rights Watch." https://techradar.com/pro/un-cybercrime-convention-inadequate-says-human-rights-watch
• Digital Watch Observatory, "Comparative analysis: the Budapest Convention vs the UN Convention Against Cybercrime." https://dig.watch/updates/comparative-analysis-the-budapest-convention-vs-the-un-convention-against-cybercrime
• epicenter.works, "Cybercrime Convention: Cross-Border Human Rights Violations." https://epicenter.works/en/content/cybercrime-convention-cross-border-human-rights-violations
• UN Press, "Secretary-General Urges All Countries to Sign, Ratify New UN Convention against Cybercrime, Calls for Solutions Rooted in Human Rights." https://press.un.org/en/2025/sgsm22961.doc.htm
• https://cyberpeace.org/resources/blogs/the-digital-leviathan-the-un-cybercrime-treaty-and-the-future-of-global-governance 
• https://cyberpeace.org/resources/blogs/the-world-is-rewriting-the-rules-against-cyber-enabled-transnational-crime 

‍

Introduction

‍

Raksha Bandhan is a cherished festival which is celebrated every year on the full moon day of the Hindu month of Shravan. It is a festival that represents the love, care, and protection that siblings share. This year, Raksha Bandhan falls on 09th August 2025. On this day, sisters tie a sacred thread known as Rakhi on their brothers' wrists as a symbol of love and protection, and in return, brothers promise to safeguard them in all walks of life. The origin of this festival traces back to the Mahabharata, when lord Krishna injured his finger. To bandage the wound, Draupadi, also known as Panchali, tore a piece of her saree and tied it on Krishna's finger. Krishna was touched by her selfless gesture and promised to always protect her, a promise he fulfilled during Drapadi’s time of greatest need. 

Today, in the evolving world driven by technology in all aspects of life, the nature of threats has evolved. In this digital age, physical safety alone is no longer enough. Alongside the traditional vow, there is now a growing need for another promise, the promise of Cyber Raksha (Cyber Safety). As we celebrate the spirit of Raksha Bandhan, this year also take the pledge of offering and taking care of the Cyber Suraksha of your sibling. 

‍

Ek Vaada Cyber Raksha ka 

‍

All the brothers and sisters share the bond of mutual care and responsibility. In the evolving threats of cybercrimes, they must understand the vulnerabilities they might face and the cyber safety tips they should be aware of to protect themselves. You must promise to guide, protect each other from online dangers, and help understand the importance of digital safety.  Hence, this Raksha Bandhan, let’s also tie a knot of cyber awareness, responsibility, and digital protection,  because true raksha in today’s age is not only about protection in the offline world, it is about protection in both the offline and online world. 

CyberPeace has curated the following best practices for you to consider in your life and also to share with your sisters and brothers.

‍

Password Security

‍

‍It is most important to realise that cybercrooks mostly have their eyes on your passwords to target and gain access to your accounts or information. Scammers try multiple ways to get access to your passwords by way of various methods such as OTP frauds, Fake login pages (spoofing), Social engineering, Credential stuffing, Brute-force attacks, phishing, etc. 

‍

Quick Tips 

‍

• Use strong passwords.
• Regularly update passwords.
• Use separate passwords for different accounts.
• Use secure & trusted password managers.
• Use two-factor authentication for an extra layer of security.
• Make sure not to save passwords on random devices.

‍

Social Media Security

‍

‍There are endless cyber scams that take place through social media, such as identity theft, cyberbullying, cyber stalking, online harassment, data leaks, suspicious links leading to phishing and malware, exposure to inappropriate content, etc. It becomes important for netizens to protect their accounts, data, and online presence on social media platforms from the growing cyber threats.

‍

Quick Tips

‍

• Review app permissions and do not give any unnecessary app permissions.
• Keep your account private or customise your privacy settings as per your needs.
• Be cautious while interacting with strangers.
• Do not click on any suspicious or unknown links.
• Make sure to log out in case you have to log in to your social media on an unfamiliar device, and update your password to prevent unauthorised access.
• Always use Two-Factor authentication for your social media accounts.
• Avoid sharing too much of your personal information on the public story or public posts. This can be used by cybercriminals for social engineering.
• Use the report & block function to protect yourself from spam accounts and unwanted interactions.
• If you encounter any issue, report it to the ‘Platform’s reporting mechanism at the ‘Help Centre’.
• One can also reach out to the platform’s grievance officer.

‍

Device Security

‍

In today’s world, the interconnectedness is unavoidable, your devices, be it smartphones, tablets, laptops are not just tools, they are digital extensions of yourself. They contain your discussions, recollections, private information, and frequently your financial and professional information. Safeguarding your devices in the digital world can be equated with safeguarding your physical possessions against undesirable encroachments. Just like a sibling would never let anyone invade your privacy, you too must promise to keep your devices secured against malicious threats like malware, spyware, ransomware, and unauthorized access.

‍

Quick Tips

‍

• Update your apps, browsers, and operating systems frequently; these updates frequently contain security vulnerabilities.
• Install reliable anti-virus and anti-malware software, then perform routine device scans.
• Do not download files or apps from unidentified sources.
• Avoid using open or unprotected public Wi-Fi for private activities like email or banking. 
• Employ screen locks (passwords, biometrics, or PINs) to stop unwanted physical access.
• Enable remote wipe or ‘find my Device’ functions in case your device is lost or stolen.

‍

Digital Payments Security

‍

‍Rakshabandhan is all about giving, but let’s not make it easy for cyber fraudsters to take! Convenience can come at a great cost. It often comes with a danger of fraud, phishing, and money-stealing schemes, as evidenced by the rise in digital payments and UPI transactions. But by being cautious, one can avoid being defrauded.  Whether you’re gifting a sibling online or shopping for festive deals, promise yourself and your loved ones that you’ll transact wisely and safely.

‍

Quick Tips

‍

• Never give out your bank credentials, CVV, OTP, or UPI PIN to anyone, even if they seem trustworthy before extensively verifying their credentials.
• Before completing a transaction, confirm the account information or UPI ID.
• Refund or payment links sent by WhatsApp accounts or unknown numbers should not be clicked. 
• Use only trusted apps (like BHIM, PhonePe, Google Pay, etc.) downloaded from official app stores.

‍

Email Security

‍

Your email serves as a key to your digital kingdom and serves as more than just a tool for communication. Your email frequently connects everything, from banking to social networking. Scammers use phishing assaults, malware attachments, and impersonation frauds to target it first.  Just like a sibling watches your back, watch your inbox. Make a vow not to fall for the digital bait.

‍

Quick tips

‍

• Never open attachments or links in emails that seem strange or suspicious.
• Subject lines that evoke fear, such as “Account Suspended,” “Urgent Action Required” should be avoided. 
• Verify the sender’s email address at all times because scammers frequently use little misspellings to deceive you.
• Set up two-factor authentication and create a secure, one of a kind password for your email accounts.
• Avoid using unprotected Wi-Fi networks or public computers to check your email.
• Avoid responding to spam emails or unsubscribing through dubious links as this could give the attacker your address. 

‍

Common scams to watch out for

‍

Festive deals scams

‍

As the festive season sales surge in India, so does the risk of cyber scams. Cyber crooks exploit the victims and urge them to share OTPs under the guise of preventing fraudulent activity, sharing malicious links to get sensitive information. 

‍

Mis-disinformation 

‍

The spread of mis-disinformation has surged on social media platforms. It spreads like wildfire across the digital landscape, and the need for effective strategies to counteract these challenges has grown exponentially in a very short period. ‘Prebunking’ and ‘Debunking’ are two approaches for countering the growing spread of misinformation online.

‍

Deepfake and Voice cloning scams

‍

By using the Deepfake technology, cybercriminals manipulate audio and video content which looks very realistic but, in actuality, is fake. Voice cloning is also a part of deepfake. To create a voice clone of anyone's, audio can be deepfaked too, which closely resembles a real one but, in actuality, is a fake voice created through deepfake technology. 

‍

Juice Jacking

‍

Cybercriminals can hack your phone using or exploiting some public charging stations, such as at airports, Malls, hotel rooms, etc. When you plug your cell phone into a USB  power charger, you may be plugging into a hacker. Juice jacking poses a security threat commonly at places that provide free charging stations for mobile devices. 

‍

Suspicious links & downloads

‍

Suspicious links & downloads can lead you to a phishing site or install malware into your system, which can even lead to compromise your device, expose sensitive data, and cause financial losses.

‍

Conclusion

‍

This Rakhi, ensure your and your sibling’s online safety and security by being cybersafe and smart. You can seek assistance from the CyberPeace Helpline at helpline@cyberpeace.net

‍

‍