#FactCheck -AI-Generated Image Falsely Shows Kavya Maran Hugging Young Cricketer Vaibhav Suryavanshi
Executive Summary
A picture allegedly showing Sunrisers Hyderabad (SRH) owner Kavya Maran emotionally hugging young cricketer Vaibhav Suryavanshi has gone viral on social media. The image is being shared as a genuine photograph from a cricket-related event, with users claiming that Kavya Maran was seen embracing Vaibhav Suryavanshi. However, CyberPeace Research Wing research found the claim to be false. No credible news reports, official statements, or authentic photographs support the incident depicted in the viral image.
Claim
A Facebook user shared the viral image with the caption: “Kavya Maran Hug Vaibhav Suryavanshi 🥰🔥 #cricketnews #RRvsSRH” The link to the post and its screenshot are provided below.
Fact Check
During the research, we found no credible news reports, official statements, or authentic images confirming that Kavya Maran hugged Vaibhav Suryavanshi as shown in the viral picture. To further verify the image, it was analysed using AI detection tools, including Sightengine and Hive Moderation. Both tools indicated a high probability that the image was generated using Artificial Intelligence. The findings suggest that the viral photograph is not a genuine image captured at a real event but a digitally created visual.
Conclusion
Our research found that the viral image showing Kavya Maran emotionally hugging Vaibhav Suryavanshi is not authentic. The picture was generated using AI and does not depict a real incident.
Related Blogs
Disclaimer:
This report is based on extensive research conducted by CyberPeace Research using publicly available information, and advanced analytical techniques. The findings, interpretations, and conclusions presented are based on the data available at the time of study and aim to provide insights into global ransomware trends.
The statistics mentioned in this report are specific to the scope of this research and may vary based on the scope and resources of other third-party studies. Additionally, all data referenced is based on claims made by threat actors and does not imply confirmation of the breach by CyberPeace. CyberPeace includes this detail solely to provide factual transparency and does not condone any unlawful activities. This information is shared only for research purposes and to spread awareness. CyberPeace encourages individuals and organizations to adopt proactive cybersecurity measures to protect against potential threats.
CyberPeace Research does not claim to have identified or attributed specific cyber incidents to any individual, organization, or nation-state beyond the scope of publicly observable activities and available information. All analyses and references are intended for informational and awareness purposes only, without any intention to defame, accuse, or harm any entity.
While every effort has been made to ensure accuracy, CyberPeace Research is not liable for any errors, omissions, subsequent interpretations and any unlawful activities of the findings by third parties. The report is intended to inform and support cybersecurity efforts globally and should be used as a guide to foster proactive measures against cyber threats.
Executive Summary:
The 2024 ransomware landscape reveals alarming global trends, with 166 Threat Actor Groups leveraging 658 servers/underground resources and mirrors to execute 5,233 claims across 153 countries. Monthly fluctuations in activity indicate strategic, cyclical targeting, with peak periods aligned with vulnerabilities in specific sectors and regions. The United States was the most targeted nation, followed by Canada, the UK, Germany, and other developed countries, with the northwestern hemisphere experiencing the highest concentration of attacks. Business Services and Healthcare bore the brunt of these operations due to their high-value data, alongside targeted industries such as Pharmaceuticals, Mechanical, Metal, Electronics, and Government-related professional firms. Retail, Financial, Technology, and Energy sectors were also significantly impacted.
This research was conducted by CyberPeace Research using a systematic modus operandi, which included advanced OSINT (Open-Source Intelligence) techniques, continuous monitoring of Ransomware Group activities, and data collection from 658 servers and mirrors globally. The team utilized data scraping, pattern analysis, and incident mapping to track trends and identify hotspots of ransomware activity. By integrating real-time data and geographic claims, the research provided a comprehensive view of sectoral and regional impacts, forming the basis for actionable insights.
The findings emphasize the urgent need for proactive Cybersecurity strategies, robust defenses, and global collaboration to counteract the evolving and persistent threats posed by ransomware.
Overview:
This report provides insights into ransomware activities monitored throughout 2024. Data was collected by observing 166 Threat Actor Groups using ransomware technologies across 658 servers/underground resources and mirrors, resulting in 5,233 claims worldwide. The analysis offers a detailed examination of global trends, targeted sectors, and geographical impact.
Top 10 Threat Actor Groups:
The ransomware group ‘ransomhub’ has emerged as the leading threat actor, responsible for 527 incidents worldwide. Following closely are ‘lockbit3’ with 522 incidents and ‘play’ with 351. Other Groups are ‘akira’, ‘hunters’, ‘medusa’, ‘blackbasta’, ‘qilin’, ‘bianlian’, ‘incransom’. These groups usually employ advanced tactics to target critical sectors, highlighting the urgent need for robust cybersecurity measures to mitigate their impact and protect organizations from such threats.
Monthly Ransomware Incidents:
In January 2024, the value began at 284, marking the lowest point on the chart. The trend rose steadily in the subsequent months, reaching its first peak at 557 in May 2024. However, after this peak, the value dropped sharply to 339 in June. A gradual recovery follows, with the value increasing to 446 by August. September sees another decline to 389, but a sharp rise occurs afterward, culminating in the year’s highest point of 645 in November. The year concludes with a slight decline, ending at 498 in December 2024 (till 28th of December).
Top 10 Targeted Countries:
- The United States consistently topped the list as the primary target probably due to its advanced economic and technological infrastructure.
- Other heavily targeted nations include Canada, UK, Germany, Italy, France, Brazil, Spain, and India.
- A total of 153 countries reported ransomware attacks, reflecting the global scale of these cyber threats
Top Affected Sectors:
- Business Services and Healthcare faced the brunt of ransomware threat due to the sensitive nature of their operations.
- Specific industries under threats:
- Pharmaceutical, Mechanical, Metal, and Electronics industries.
- Professional firms within the Government sector.
- Other sectors:
- Retail, Financial, Technology, and Energy sectors were also significant targets.
Geographical Impact:
The continuous and precise OSINT(Open Source Intelligence) work on the platform, performed as a follow-up action to data scraping, allows a complete view of the geography of cyber attacks based on their claims. The northwestern region of the world appears to be the most severely affected by Threat Actor groups. The figure below clearly illustrates the effects of this geographic representation on the map.
Ransomware Threat Trends in India:
In 2024, the research identified 98 ransomware incidents impacting various sectors in India, marking a 55% increase compared to the 63 incidents reported in 2023. This surge highlights a concerning trend, as ransomware groups continue to target India's critical sectors due to its growing digital infrastructure and economic prominence.
Top Threat Actors Group Targeted India:
Among the following threat actors ‘killsec’ is the most frequent threat. ‘lockbit3’ follows as the second most prominent threat, with significant but lower activity than killsec. Other groups, such as ‘ransomhub’, ‘darkvault’, and ‘clop’, show moderate activity levels. Entities like ‘bianlian’, ‘apt73/bashe’, and ‘raworld’ have low frequencies, indicating limited activity. Groups such as ‘aps’ and ‘akira’ have the lowest representation, indicating minimal activity. The chart highlights a clear disparity in activity levels among these threats, emphasizing the need for targeted cybersecurity strategies.
Top Impacted Sectors in India:
The pie chart illustrates the distribution of incidents across various sectors, highlighting that the industrial sector is the most frequently targeted, accounting for 75% of the total incidents. This is followed by the healthcare sector, which represents 12% of the incidents, making it the second most affected. The finance sector accounts for 10% of the incidents, reflecting a moderate level of targeting. In contrast, the government sector experiences the least impact, with only 3% of the incidents, indicating minimal targeting compared to the other sectors. This distribution underscores the critical need for enhanced cybersecurity measures, particularly in the industrial sector, while also addressing vulnerabilities in healthcare, finance, and government domains.
Month Wise Incident Trends in India:
The chart indicates a fluctuating trend with notable peaks in May and October, suggesting potential periods of heightened activity or incidents during these months. The data starts at 5 in January and drops to its lowest point, 2, in February. It then gradually increases to 6 in March and April, followed by a sharp rise to 14 in May. After peaking in May, the metric significantly declines to 4 in June but starts to rise again, reaching 7 in July and 8 in August. September sees a slight dip to 5 before the metric spikes dramatically to its highest value, 24, in October. Following this peak, the count decreases to 10 in November and then drops further to 7 in December.
CyberPeace Advisory:
- Implement Data Backup and Recovery Plans: Backups are your safety net. Regularly saving copies of your important data ensures you can bounce back quickly if ransomware strikes. Make sure these backups are stored securely—either offline or in a trusted cloud service—to avoid losing valuable information or facing extended downtime.
- Enhance Employee Awareness and Training: People often unintentionally open the door to ransomware. By training your team to spot phishing emails, social engineering tricks, and other scams, you empower them to be your first line of defense against attacks.
- Adopt Multi-Factor Authentication (MFA): Think of MFA as locking your door and adding a deadbolt. Even if attackers get hold of your password, they’ll still need that second layer of verification to break in. It’s an easy and powerful way to block unauthorized access.
- Utilize Advanced Threat Detection Tools: Smart tools can make a world of difference. AI-powered systems and behavior-based monitoring can catch ransomware activity early, giving you a chance to stop it in its tracks before it causes real damage.
- Conduct Regular Vulnerability Assessments: You can’t fix what you don’t know is broken. Regularly checking for vulnerabilities in your systems helps you identify weak spots. By addressing these issues proactively, you can stay one step ahead of attackers.
Conclusion:
The 2024 ransomware landscape reveals the critical need for proactive cybersecurity strategies. High-value sectors and technologically advanced regions remain the primary targets, emphasizing the importance of robust defenses. As we move into 2025, it is crucial to anticipate the evolution of ransomware tactics and adopt forward-looking measures to address emerging threats.
Global collaboration, continuous innovation in cybersecurity technologies, and adaptive strategies will be imperative to counteract the persistent and evolving threats posed by ransomware activities. Organizations and governments must prioritize preparedness and resilience, ensuring that lessons learned in 2024 are applied to strengthen defenses and minimize vulnerabilities in the year ahead.
Executive Summary
A video is being shared on social media showing a little girl crying while holding onto a pole amid muddy water covering a road. The video is being shared with the claim that it shows the situation during the recent floods in Nepal. A research by CyberPeace’s Research Wing found the viral claim to be false. Our research revealed that the viral video is AI-generated and is being shared with a misleading claim.
Claim:
A user on the social media platform Instagram shared the viral video with the caption: “The situation in Nepal looks extremely frightening after the floods. Floodwater has covered the area, and the frightened face of a little girl amid the water is moving everyone emotionally. Seeing the innocent girl’s condition in this difficult situation has raised concerns among people.”
https://www.instagram.com/reels/DctRY9OF0Th/
Fact Check
A reverse image search of keyframes from the viral video on Google did not yield any credible media reports related to the video. Upon closely examining the viral video, we suspected that it might be AI-generated. We subsequently scanned the video using the AI detection tool Hive Moderation. According to the results, the video has a 99 percent probability of being AI-generated.
As part of the next step of ourresearch, we scanned the viral video using another AI detection tool, Sightengine. According to the results, the video has a 99 percent probability of being AI-generated.
Conclusion
Our research found that the viral video is AI-generated and is being shared with a misleading claim.
Introduction
Imagine a fraud that starts with an advertisement then goes through a messaging service and finally ends when a criminal receives a payment. The victim experiences one incident but the fraud moves through many services. This makes cyber fraud a question of how institutions coordinate and how people stay alert. A statement from the Ministry of Finance in March 2026 described fraud analytics, ways to detect mule accounts and advice for updated customer protection. These actions give a starting point, for looking at how responsibility should be shared. What warning signs can each participant in the fraud chain recognize? How soon should institutions coordinate? How can a victim find help without having to navigate many separate complaint processes?
- Following the Chain of Services
Looking at fraud as a series of interactions can show where help is needed. An ad might present an offer. A conversation might create trust. A payment request could turn that trust into money loss. Different services see parts of the same scam.
Take a job scam. An online ad might draw in a job seeker. That leads to a chat. Then comes a demand for a registration fee. The ad platform may know the advertiser. The bank may see the money moving to a receiving account. Neither sees the full story.
This leads to a policy problem. How do you connect the dots when no single service has all the information? A good answer would focus on signals of danger, how a scam can grow worse and who is responsible at each step. It must also separate the criminal’s actions, from whether someone else should have done more. Being part of a transaction chain doesn’t mean you broke the law. The key is to focus on what happened, not who was involved.
- What the March 2026 Developments Show
The Ministry of Finance’s statement of 24 March 2026 outlined initiatives. Among them was the creation of the Indian Digital Payment Intelligence Corporation. It also mentioned the use of "MuleHunter.AI" to detect accounts involved in moving funds. The statement included details about real-time monitoring and analytical tools for tracking activity.
It was noted that revised RBI customer protection instructions were issued for consultation on 6 March 2026. These included a proposed compensation mechanism for value fraudulent electronic banking transactions. This shows there was a consultation process at that time. It does not mean every idea in the proposal became a binding rule.
These steps contribute to a conversation on how to prevent fraud and support those who are harmed. Announcements alone are not enough. It is important to look at what happens in practice. Key questions remain: Can financial institutions detect behaviour accurately? Do they act fast to stop the damage? Can users who are affected challenge decisions they believe are wrong?
Technology must help create a system that is open and accountable. Institutions must be able to explain how they make decisions and how those decisions are reviewed. A reliable process requires clarity, oversight and the ability to correct errors.
- Allocating Responsibility Fairly
Shared accountability needs to start with what each person or group can do. A service needs to be checked against the laws that apply to it. What actually happened. Saying “someone has to be responsible” doesn't help with stopping problems or making choices.
As a rule, for how things should work, responsibility should look at controlling what information is available. The ability to act. An organization that gets a warning might have different issues, than one that didn't know anything. Also, a system made to find account activity should be looked at differently than a place checking advertisement.
This method also stops putting all the work on the person. People need to keep their passwords safe and tell others if something is wrong. Organizations should check their own ways. Clear rules can show where more checks are needed and where much hassle would leave people out. The goal should be a way to share responsibility, based on facts not guesses about what the person did.
- Why Transaction Classification Matters
A payment made without a customer’s permission and a payment the customer was tricked into agreeing to create issues. The difference is important when looking at the protections that apply. The situation that led to the loss. A blog should therefore not say that every fraud case leads to the refund decision.
For a pretend complaint helpful details could be how the transaction took place, what the customer agreed to, what information was stolen and when the company found out. These facts need to be looked at using the rules and any proof that exists. A short story of what happened might not answer all the questions.
Companies should explain why they made a decision using words that customers can understand. If the answer only mentions “customer responsibility” in a way it won’t help much. A good response should list the facts that matter, explain why the decision was made and tell the customer how to ask for a review. This will make the process clearer without saying that every claim will be handled the way.
- Building a Usable Response System
A person who reports fraud should know exactly what will happen next. Clear acknowledgement, complaint reference and regular updates will cut down on uncertainty. When many institutions must act their procedures should cut down on repetition while still following the law on sharing information.
Preserving evidence also needs attention. A complainant may keep messages, transaction records or screenshots that matter to an investigation. A reporting interface should tell the complainant which information’s useful and give secure ways to submit it. The interface should avoid asking for credentials or unrelated personal data.
Prevention tools need their safeguards. A system might flag activity for review even if it does not prove that the account holder did anything. The institution should give ways to fix mistaken restrictions. Performance should be judged by fraud detection, responses, how complaints end and how errors are fixed. These measures will link activity to the experience of the people the system is meant to help.
CONCLUSION
Cyber fraud policy needs to bring awareness together with institutional prevention and easy ways to get help. The steps that happen during an incident offer chances to spot danger but it is important to check responsibility carefully using the right duties and proof. New developments from March 2026 show that people are paying attention to fraud analysis and protecting customers. There are still big questions about how to put these ideas into action. Organizations should explain their choices, work together through steps and give real options for checking things again. People should get help and not be seen as the only way to stop fraud. A digital economy that people trust depends on whether they can use its services with confidence and get a fair response when something goes wrong.
References
