#FactCheck: Phishing Scam of Kisan Tractor Yojana government scheme offering subsidy on purchase of Tractors

Introduction

For years, when Meta's automated systems flagged suspected child sexual abuse material on Facebook or Instagram involving an Indian child, that information did not go straight to an Indian police station. It went first to a private, US based nonprofit, the National Center for Missing & Exploited Children (NCMEC), which would then decide how and when to route the relevant details back to law enforcement in the country where the crime actually happened. That indirect chain has now been shortened. In mid September 2026, senior Indian government officials confirmed that Meta had agreed, for the first time among major social media platforms operating in India, to report child sexual abuse cases and details of repeat offenders directly to the cybercrime division of the Indian Cyber Crime Coordination Centre, commonly known as I4C, under the Ministry of Home Affairs. Google followed within days with a similar commitment of its own.

How the reporting actually worked before this

Under US federal law, Meta and every other American headquartered platform is legally obligated to report CSAM instances to NCMEC, facing criminal liability, financial penalties, and the loss of legal safe harbour protections if they fail to do so. NCMEC would then coordinate with law enforcement agencies in the relevant country. In India's case, that meant a 2019 memorandum of understanding between NCMEC and the National Crime Records Bureau, through which more than 69 lakh CyberTipline reports had reportedly been shared with Indian states and union territories by early 2024. The structural problem was not the volume of reports; it was the layer of institutional distance built into every single one of them. As one government official put it plainly, an Indian law enforcement agency was, in effect, made to wait on a private American nonprofit for information about a crime committed on Indian soil against an Indian child, and NCMEC itself has little to no operational presence in India to manage that handoff quickly.

That distance had real, documented costs. Officials directly linked slow data sharing to delayed CSAM investigations, describing situations where exploitation was actively ongoing while Indian agencies remained one step removed from the account level details, IP addresses, and identifying information that could have accelerated a rescue or an arrest.

What actually changed, and why now

This shift did not emerge from a routine policy review. It followed sustained government pressure through 2026, including a formal inquiry launched by the National Commission for Protection of Child Rights into Meta India's child safety policies, multiple summons issued to Meta India head, and a July 2026 controversy in which Meta was found to have run paid Instagram advertisements allegedly directing users toward Telegram channels distributing CSAM. 

Union Minister Ashwini Vaishnaw directly raised the direct reporting demand with Meta's Chief of Global Affairs, Joel Kaplan, during a visit to New Delhi in August 2026, and separately questioned whether Meta could still claim to be a "simple intermediary" given that it profits from advertisement placement and exercises systems level control over ad distribution. Under the new arrangement, account level details, including names, associated email addresses, and IP addresses, will now flow directly to I4C, which officials say should meaningfully compress the time between detection and actionable law enforcement response.

Why this is a welcome step, but not a solved problem

There is genuine reason to treat this as meaningful progress. For years, reporting routed through NCMEC meant Indian agencies were effectively once removed from data concerning crimes committed on Indian soil, against Indian children. Direct reporting to I4C shortens that distance and gives investigators quicker access to information that matters most in time sensitive cases, where every day of delay can mean continued access, continued distribution, or a victim who remains unidentified.

That said, this should not be described as a finished problem, and its real value will depend on at least three things.

The first is the depth of data actually shared. Account level details, a name, an email address, an IP address, are a starting point for an investigation, not an end point. Whether the new arrangement includes the kind of contextual detail investigators actually need to build a prosecutable case, rather than simply a faster version of the same limited data packet previously routed through NCMEC, remains to be seen in practice rather than in the announcement itself.

The second is institutional capacity on the receiving end. I4C and state cyber cells will now be positioned to receive a higher volume of reports arriving faster than before, but a faster pipeline only produces better outcomes if the infrastructure receiving it can actually convert that inflow into timely, actionable results on the ground. India's cyber cells have historically been understaffed and unevenly resourced across states, with some districts operating with only a handful of trained personnel handling cybercrime alongside a broad range of other digital offences. A genuinely improved reporting channel could, in that context, simply shift the bottleneck downstream from Washington to a district cyber cell rather than eliminate it, unless the surge in report volume is matched by a corresponding investment in trained staff, forensic capacity, and case management systems capable of prioritising the most time sensitive reports first.

The third is consistency across the industry. Meta and Google have now committed to this model, but whether it extends reliably across every major platform operating in India, rather than remaining an arrangement secured through targeted pressure on one or two companies at a time, will determine whether this becomes a systemic fix or a set of isolated exceptions.

The quieter tension nobody has fully resolved

There is also a more technical reality worth naming honestly. As platforms adopt end to end encryption more broadly, extending it across messaging services and, in some cases, considering it for other content types, the pool of CSAM content that can actually be automatically detected narrows, even as the reporting pipeline for whatever is detected improves. WhatsApp itself has argued in Indian courts, including in its ongoing challenge to the IT Rules' traceability requirements, that end to end encryption and message traceability are close to mutually exclusive, a position echoed by cryptography experts including Signal's Moxie Marlinspike, who has stated plainly that identifying a message's originator at the very least undermines, and likely breaks, the purpose of end to end encryption altogether. Faster reporting channels do not, by themselves, compensate for reduced visibility into content that a platform's own encryption prevents it from scanning in the first place. That tension, between strengthening user privacy through encryption and strengthening child safety through detection, sits underneath this entire announcement and deserves sustained attention from technologists, platforms, and child safety practitioners alike, rather than being treated as resolved simply because reporting speed has improved.

India's National Human Rights Commission has already flagged this directly in its own advisory, recommending that platforms using end to end encryption be required to devise additional protocols or technology specifically to monitor CSAM circulation, an unresolved and technically difficult ask that sits alongside, rather than instead of, the reporting improvements announced this month.

What this actually represents

The most accurate way to characterise this development is as a meaningful first step in platform accountability toward children in India, not a finish line. Meta agreeing to report directly, rather than through a private American intermediary, closes a real structural gap that officials say genuinely delayed investigations. But the task now shifts to India itself: building the institutional capacity at I4C and in state cyber cells to make full use of what is finally being offered, extending the same commitment across the rest of the industry rather than platform by platform, and confronting the encryption question honestly rather than treating faster reporting as a substitute for solving it.

A judicial note worth remembering

It is worth noting that Indian courts pushed for this same sensitivity well before it became routine practice. The Supreme Court, in Just Rights for Children Alliance v. S. Harish, 2024, directed that the term "child pornography" be replaced with "child sexual abuse and exploitation material" across legal and public usage, holding that the word "pornography" wrongly implies consent and normalises what is, in fact, a recorded act of abuse. That judicial insistence on precise language is a useful reminder that reporting frameworks like this one will ultimately be judged not just on speed, but on whether they treat the material, and the children in it, with the gravity courts have already demanded.

References

1. https://www.business-standard.com/industry/news/meta-agrees-to-share-csam-details-with-indian-law-enforcement-agencies-125091500052_1.html
2. https://www.business-standard.com/technology/tech-news/google-india-to-share-csam-case-details-with-govt-cybercrime-division-126092101062_1.html
3. https://www.storyboard18.com/advertising/ncpcr-summons-meta-india-md-again-over-child-abuse-ads-ws-l-110781.htm
4. https://www.superprep.io/current-affairs/meta-report-csam-directly-to-indias-cybercrime-portal
5. https://theprint.in/india/specialised-central-police-unit-use-of-technology-to-proactively-detect-csam-nhrc-advisory/1822223/
6. https://www.livelaw.in/news-updates/whatsapp-delhi-high-court-traceability-end-to-end-encryption-privacy-risk-174743
7. https://www.forbesindia.com/article/take-one-big-story-of-the-day/traceability-and-endtoend-encryption-cannot-coexist-on-digital-messaging-platforms-experts/66969/1

‍

Introduction 
‍

In recent years, India has seen tremendous growth in its space industry. The satellite infrastructure of India now provides key services to a variety of sectors, including communication, navigation, broadcasting, disaster management and national security operations. Satellite communications globally will connect remote communities, aid in the delivery of Digital Governance and support India's strategic military capabilities. Given the expanding space ecosystem in India with the involvement of the public sector, private sector and research institutions, the security of satellite communications is becoming increasingly important.  

 At the same time, as satellite communication technologies become more pervasive, the risk of cyber threats targeting space systems increases. Cyberattacks against satellites, ground terminals or communication networks may critically impact, disrupt, damage, and/or destroy essential services, and expose sensitive information. To mitigate these risks, CERT-In (Computer Emergency Response Team), in collaboration with the SatCom Industry Association of India released a Cyber Security Framework and Guidelines for Space Platforms/Systems, including Satellite Communication, in 2026. This framework aims to establish and enhance cybersecurity measures throughout India's space ecosystem, while guiding how to better prepare for and respond to the growing volume of cyber threat activity targeting Space Systems. 
‍

Overview of the CERT-In Space Cybersecurity Framework 
‍

CERT-In introduced a dedicated cybersecurity framework for space systems in February 2026. Developed in collaboration with industry stakeholders, the framework provides guidelines to strengthen the security of satellite communication infrastructure across India. Although the guidelines are advisory in nature, they are designed to promote best practices and encourage organisations to adopt robust cybersecurity measures. 

The framework targets a wide range of stakeholders involved in satellite communication operations. These include government agencies, satellite operators, ground station operators, equipment manufacturers, technology vendors, and emerging space startups. By outlining cybersecurity principles, technical controls, and governance mechanisms, the framework aims to create a coordinated approach to protecting space assets. 

Another key objective of the guidelines is to foster collaboration between the public and private sectors. As India’s space industry expands and private participation increases, maintaining a secure and resilient ecosystem becomes essential. The framework, therefore, emphasises risk management, incident reporting, and continuous monitoring to strengthen the overall cybersecurity posture of the space sector. 
‍

Key Components of Satellite Communication Systems 
‍

Satellite communication systems are made up of multiple interconnected devices that can be used to deliver communication services. The cybersecurity framework groups these elements into three categories: the space segment, the ground segment, and the user segment.  

The space segment is everything related to the satellite itself, including the satellite's onboard systems. This includes the satellite's communication payload, telemetry systems, antennas, power systems, and software that controls its operation. Because satellites operate in remote parts of space with very little opportunity for maintenance, securing these systems is critical in order to guard against unauthorized access to or control of these systems.  

The ground segment comprises the terrestrial infrastructure responsible for controlling the satellite's operations. It consists of satellite mission control centres, ground stations, network gateways and data processing facilities. The ground stations send commands to the satellites and receive telemetry data from the satellites, which makes the ground station a very important physical interface point between the satellite asset located in outer space and a terrestrial network. 

The user segment contains any device terminal being used by either an individual or an organisation that is accessing a satellite service. Examples of user devices are satellite phones, VSAT terminals, modems, and IoT devices connected to satellite networks. Since these devices connect directly to the communication networks, vulnerabilities in user equipment could also represent a significant threat to the cybersecurity of satellite communications. 

Major Cyber Threats to Space Infrastructure 
‍

The space systems that support the delivery of satellite communications are being increasingly targeted with multiple types of cyber threats. A major category includes cyber-attacks on communication links between satellites and ground stations. Cyber criminals can attempt to jam the satellite’s communication link, intercept communication signals, or re-transmit previously sent communication signals in order to disrupt the operation of the affected satellites. 

Attacks on the systems that control the satellite are serious threats to satellite operations. Cybercriminals and hostile actors can perform command injection attacks where commands are sent to a satellite, and the satellite responds through some undesired action. If cybercriminals are able to gain access to the telemetry or command channels, they can potentially disrupt the operation of the satellite or alter the telemetry data being received from the satellite. 

The ground infrastructure that supports satellite communications is still a major target for cybercriminals. Mission control networks and data centres are susceptible to malware, ransomware, phishing, and insider threats. Attackers will frequently target ground stations because they provide a connection point to terrestrial networks and can exploit vulnerabilities from the ground station’s IT systems into the satellite control systems. The combination of these threats illustrates the need for an overall security strategy that encompasses all parts of the satellite communications ecosystem. 
‍

Key Security Principles and Measures 
‍

A comprehensive overview of multiple principles designed to increase the security of satellite communications is provided in the CERT-In Framework on Cybersecurity for Satellite Communications. The first of these principles, security by design, refers to ensuring that all cybersecurity controls associated with a system are implemented at the time of the system's initial design and development, not afterwards; therefore, security controls should be incorporated throughout the entire lifecycle of a satellite system. 

The second principle, which is known as Defense-in-Depth, consists of implementing many different layers or tiers of security controls to protect a system against cyber threats or attacks. An example of the different categories of security controls includes physical security, network security, and access control, among others. By combining security controls across multiple categories, an organisation may be able to reduce the chance that one single vulnerability will result in the loss of the entire system. 

The third principle in the Framework, Zero Trust Architecture (ZTA): Users and/or devices located within a network should not be able to rely on implicit trust. Therefore, every request for access to the network will be verified and continuously monitored for potential threats. 

The previous two principles stated that secure satellite communications should be conducted using strong encryption and authentication methods, as well as secure communications methods, and that an enterprise monitoring system would be put into place to help detect anomalies or suspicious behaviour. 

Conclusion 
‍

India is taking an important step toward protecting its expanding space ecosystem by creating a cybersecurity framework to safeguard cyberspace systems from cyber threats. The CERT-In guidelines offer a structured means of reducing the likelihood of cyber threats impacting satellite communication infrastructure through secure system design, continuous monitoring of systems and creating consistent partnerships among organisations. As well as providing evidence that both government and private sector organisations share a collective responsibility for the protection of space assets, both sectors participate in a collaborative effort.

India will need to implement rigorous cybersecurity measures as it expands its space infrastructure in order to ensure the continued availability of critical space infrastructure and ultimately develop its existing commercial satellite business operations with the highest level of safety and security.

References 
‍

1. https://www.cert-in.org.in/s2cMainServlet?pageid=GUIDLNVIEW02&refcode=CISG-2026-01
2. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2233122&reg=3&lang=1

‍

Introduction

‍

In today’s cybersecurity landscape, ransomware has emerged as one of the most significant and rapidly growing cyber threats. What began as attacks carried out by individual hackers has evolved into a highly organised criminal enterprise, with groups operating through structured business models and global networks. The emergence of The Gentlemen ransomware group reflects this transformation, demonstrating how modern threat actors can quickly expand their operations and target organisations across multiple sectors. Their rise highlights the increasing sophistication of ransomware campaigns and the growing challenges faced by organisations in defending against them. The attribution of the group's administrator to an identified individual in Izhevsk, Russia, provides a valuable lens through which to examine three interconnected developments: the maturation of ransomware-as-a-service (RaaS) business models, the inherent operational security (OPSEC) weaknesses that emerge over the course of cybercriminal careers, and the geopolitical environments that enable such actors to operate with relative impunity. Together, these dynamics illustrate the industrialisation of modern cybercrime.

‍

The Industrialisation of Ransomware-as-a-Service

‍

The remarkable rapid rise of The Gentlemen is impossible without discussing the maturation of ransomware-as-a-service (RaaS). RaaS systems utilize network intrusion experts as affiliates who conduct networks intrusions and secure access in exchange for a cut of the total ransoms paid, while a core group builds and maintains the ransomware framework itself. Although Reveton, one of the earliest Raas providers, can be credited with bringing early iterations of RaaS to fruition in 2012, the potential scale was truly evident in the mid-2020s. By 2025 it was estimated that there were over 100 active ransomware gangs operating; this proliferation is the direct result of the franchise-like system, which has lowered the barriers to entry for cybercrime. 

The marketplace surrounding RaaS is intensely competitive, and this is clearly exemplified in the business structure of The Gentlemen: while many of the top ransomware groups provide an 80/20 profit share (with the majority of the profit going to the affiliates), The Gentlemen has an exceptionally profitable 90/10 split (affiliates keep 90% of the profit share) for affiliates, likely to draw experienced operators away from their rivals given recent decreases in victim willingness to pay and corresponding increases in the incentives RaaS platforms are required to offer. 

The operational efficiency of the group is representative of a successful enterprise. They attack vulnerable internet-facing VPNs and firewalls and generally complete the network encryption within a matter of hours, leaving defenders with very little time to respond, as confirmed by Check Point Software, a renowned cybersecurity vendor.

Additionally, PRODAFT reports that the administrator of The Gentlemen, known by the alias Zeta88 (previously known as Hastalamuerte), directly provides affiliates with SSL VPN credentials, often obtained through brutal force attacks or their own private leaked databases, indicating an unusually high level of vertical integration for RaaS groups.

‍

AI as a Force Multiplier in Ransomware Development

‍

A particularly significant aspect of the Hastalamuerte case is PRODAFT's finding that the administrator employs artificial intelligence to develop and maintain ransomware, support associated tooling, and assist post-exploitation operations. This reflects a broader trend observed across the 2025–2026 threat landscape, where AI has increasingly lowered the capability threshold for participation in organised cybercrime. Researchers have documented its role in automating stages of intrusion, accelerating malware development cycles, and simplifying the maintenance of malicious infrastructure. These capabilities have been leveraged by both nation-state actors and criminal enterprises.

The trajectory of Hastalamuerte is especially illustrative. Cybersecurity Forum posts during 2019-2020 depict a hacker who is fairly novice at fundamental penetration testing procedures. A subsequent emergence as the operator of a top-tier ransomware-as-a-service operation indicates that AI-assisted development may be responsible for dramatically reducing the skill level and time necessary to create a successful criminal enterprise in cyberspace. The evolution of these tools should make the route from novice forum user to accomplished ransomware operator more attainable for a wider array of perpetrators in the future.

‍

The OPSEC Paradox: How Cybercriminals Leave a Trail

‍

The attribution of Hastalamuerte's identity by researchers from Intel 471, Flashpoint, and Constella Intelligence demonstrates the effectiveness of modern open-source and commercial intelligence methodologies. A forum registration traceable to an IP address from Izhevsk, Russia linked a Protonmail address, which linked to an Apple account, a GitHub profile, a Telegram handle, a Russian phone number, and finally to a 36 year old marketing professional named Alexander Andreevich Yapaev who was also living in Izhevsk. Investigators did not use an advanced capability in their attribution, but rather a simple OPSEC mistake of consistently reusing credentials. Every username and email address and every phone number creates a linkage between disparate data points, eventually building into a real-world persona. 

It has also come out in the forum discussion that while training for a penetration testing course in 2020, Hastalamuerte displayed the kind of inexperience that a novice would display in traceable, recorded fashion to intelligence databases. It's an example of a broader rule about attribution; attacker mistakes provide the most value. With Russians the lack of apparent consequences may contribute to a lack of need to maintain tight OPSEC from the start.

‍

The Russian Safe Haven: Conditional Impunity and Its Limits

‍

Yapaev's base in Izhevsk is emblematic of the geostrategic situation that has allowed Russian cybercriminality to prosper. Security researchers routinely label Russia's policy as one of "controlled impunity," where the cybercriminality directed at foreign entities is ignored or implicitly condoned, while that directed at Russian interests will prompt a law enforcement response. This constitutes what has been called a "managed market" rather than an "unconditional sanctuary," where many of the named defendants could and likely will continue their illegal enterprise with little fear of reprisal, provided that they do not threaten the interests of the Russian state and do not attempt to move their operations outside of Russian control.

Yet this protection is neither absolute nor permanent. In May 2024, the transnational Operation Endgame campaign highlighted the growing global appetite for damaging the cybercrime ecosystem rooted in Russia. Russian authorities did indeed pursue and seize some assets and operators, but arrests seem largely confined to the lower-rung facilitators of these attacks (hosting providers and payment services), and it seems higher-end ransomware operators continue to evade scrutiny. Selective enforcement thus further bolsters the perception that protection is accorded according to strategic value, not legal standards. For operators such as Hastalamuerte, who possess no publicly documented intelligence connections, growing attribution capabilities, and sustained international pressure may gradually erode the security traditionally associated with operating from within Russia.

‍

Attribution as a Deterrence Instrument

‍

The public identification of Alexander Andreevich Yapaev as Hastalamuerte/Zeta88 shows the continued struggle with the utility of attribution in situations where immediate prosecution is not feasible. Its utility is far more extensive than simply an ability to make an arrest. Functionally, public naming forces a perpetrator into an open evidentiary space and can lead to alterations in their operational habits and effectiveness. Strategically, attribution provides future leverage for sanctions, indictments, financial restrictions, or extradition if the target can leave their safe haven country. The logic behind US rewards programs (paying up to $10 million for the capture and conviction of ransomware operators) relies on this principle. The analytical insight provided by the case cannot be understated either. Hastalamuerte's trajectory from a relative amateur forum participant on Nulled and Raidforums in 2019 to leading a significant ransomware operation by 2026 offers an invaluable look into the career progression of a cyber criminal. It confirms one of the lessons learned through deterrence and attribution: pseudonymity is not everlasting, and many years of OPSEC failures can be pieced together to establish a real-world identity.

‍

Conclusion

‍

The Gentlemen incident is emblematic of the three broad themes that currently characterise cyber warfare: ransomware-as-a-service through innovative competition, common OPSEC failures that enable attribution, and a new, conditional regime of protection for Russian cybercriminals. The obvious defense lesson: increasing attack surfaces require stronger identity, behavioural monitoring, and intelligence capacities. The policy lesson: effective attribution is still an essential tool for comprehension, deterrence, and disruption in an increasingly industrialised environment of criminals supporting each other's operations in ransomware-as-a-service.

‍

References

‍

1. https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/
2. https://www.recordedfuture.com/
3. https://www.vectra.ai/topics/ransomware-as-a-service
4. https://www.trmlabs.com/es/resources/blog/new-disruption-opportunities-in-the-evolving-ransomware-ecosystem

‍