#FactCheck -AI-Generated Video Falsely Claims Iran Unveiled B-2-Like Drone During War

Executive Summary:

‍

A viral video claims to show a massive cumulonimbus cloud over Gurugram, Haryana, and Delhi NCR on 3rd September 2025. However, our research reveals the claim is misleading. A reverse image search traced the visuals to Lviv, Ukraine, dating back to August 2021. The footage matches earlier reports and was even covered by the Ukrainian news outlet 24 Kanal, which published the story under the headline “Lviv Covered by Unique Thundercloud: Amazing Video”. Thus, the viral claim linking the phenomenon to a recent event in India is false.

Claim:

‍

A viral video circulating on social media claims to show a massive cloud formation over Gurugram, Haryana, and the Delhi NCR region on 3rd September 2025. The cloud appears to be a cumulonimbus formation, which is typically associated with heavy rainfall, thunderstorms, and severe weather conditions.

‍

‍

Fact Check:

‍

After conducting a reverse image search on key frames of the viral video, we found matching visuals from videos that attribute the phenomenon to Lviv, a city in Ukraine. These videos date back to August 2021, thereby debunking the claim that the footage depicts a recent weather event over Gurugram, Haryana, or the Delhi NCR region.

‍

‍

‍

Further research revealed that a Ukrainian news channel named  24 Kanal, had reported on the Lviv thundercloud phenomenon in August 2021. The report was published under the headline “Lviv Covered by Unique Thundercloud: Amazing Video” ( original in Russian, translated into English). 

‍

‍

‍

Conclusion:

‍

The viral video does not depict a recent weather event in Gurugram or Delhi NCR, but rather an old incident from Lviv, Ukraine, recorded in August 2021. Verified sources, including Ukrainian media coverage, confirm this. Hence, the circulating claim is misleading and false. 

‍

• Claim: Old Thundercloud Video from Lviv city in Ukraine Ukraine (2021) Falsely Linked to Delhi NCR, Gurugram and Haryana.
• Claimed On: Social Media
• Fact Check: False and Misleading.

Introduction

Search Engine Optimisation (SEO) is a process through which one can improve website visibility on search engine platforms like Google, Microsoft Bing, etc. There is an implicit understanding that SEO suggestions or the links that are generated on top are the more popular information sources and, hence, are deemed to be more trustworthy. This trust, however, is being misused by threat actors through a process called SEO poisoning.

SEO poisoning is a method used by threat actors to attack and obtain information about the user by using manipulative methods that position their desired link, web page, etc to appear at the top of the search engine algorithm. The end goal is to lure the user into clicking and downloading their malware, presented in the garb of legitimate marketing or even as a valid result for Google search.

An active example of attempts at SEO poisoning has been discussed in a report by the Hindustan Times on 11th November, 2024. It highlights that using certain keywords could make a user more susceptible to hacking. Hackers are now targeting people who enter specific words or specific combinations in search engines. According to the report, users who looked up and clicked on links at the top related to the search query “Are Bengal cats legal in Australia?” had details regarding their personal information posted online soon after.

SEO Poisoning - Modus Operandi Of Attack

There are certain tactics that are used by the attackers on SEO poisoning, these are:

• Keyword stuffing- This method involves overloading a webpage with irrelevant words, which helps the false website appear higher in ranking.
• Typosquatting- This method involves creating domain names or links similar to the more popular and trusted websites. A lack of scrutiny before clicking would lead the user to download malware, from what they thought was a legitimate site.
• Cloaking- This method operates by showing different content to both the search engines and the user. While the search engine sees what it assumes to be a legitimate website, the user is exposed to harmful content.
• Private Link Networks- Threat actors create a group of unrelated websites in order to increase the number of referral links, which enables them to rank higher on search engine platforms.
• Article Spinning- This method involves imitating content from other pre-existing, legitimate websites, while making a few minor changes, giving the impression to search engine crawlers of it being original content.
• Sneaky Redirect- This method redirects the users to malicious websites (without their knowledge) instead of the ones the user had intended to click.

CyberPeace Recommendations

• Employee Security Awareness Training: Security awareness training can help employees familiarise themselves with tactics of SEO poisoning, encouraging them to either spot such inconsistencies early on or even alert the security team at the earliest. 
• Tool usage: Companies can use Digital Risk Monitoring tools to catch instances of typosquatting. Endpoint Detection and Response (EDR) tools also help keep an eye on client history and assess user activities during security breaches to figure out the source of the affected file.
• Internal Security Measures: To refer to lists of Indicators of Compromise (IOC). IOC has URL lists that show evidence of the strange behaviour of websites, and this can be used to practice caution. Deploying Web Application Firewalls (WAFs) to mitigate and detect malicious traffic is helpful.

Conclusion

The nature of SEO poisoning is such that it inherently promotes the spread of misinformation, and facilitates cyberattacks. Misinformation regarding the legitimacy of the links and the content they display, in order to lure users into clicking on them, puts personal information under threat. As people trust their favoured search engines, and there is a lack of awareness of such tactics in use, one must exercise caution while clicking on links that seem to be popular, despite them being hosted by trusted search engines.

References

• https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/what-is-seo-poisoning/
• https://www.vectra.ai/topics/seo-poisoning
• https://www.techtarget.com/whatis/definition/search-poisoning
• https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/seo-poisoning
• https://www.coalitioninc.com/blog/seo-poisoning-attacks
• https://www.sciencedirect.com/science/article/abs/pii/S0160791X24000186
• https://www.repindia.com/blog/secure-your-organisation-from-seo-poisoning-and-malvertising-threats/ 
• https://www.hindustantimes.com/technology/typing-these-6-words-on-google-could-make-you-a-target-for-hackers-101731286153415.html

‍

Introduction

‍

India is confronting a wake-up call as a recent cyber incident aimed at the aviation sector underscores the fragile nature of digital systems that guide national air travel. The disclosure in Parliament has pushed the conversation on flight safety, signal integrity, and cyber readiness back into urgent focus. In a written response to a Parliamentary question, Civil Aviation Minister Ram Mohan Naidu acknowledged that GPS spoofing, a malicious method employed to alter navigation signals, had been noticed at seven major airports of the country. New Delhi flights had not been affected during the incident, but still, it was an event that again made air travel's safety, GNSS interference, and the overall cyber threat to India's airspace an issue of concern.

‍

The Incident: What Happened?

‍

Initial notices came from Indira Gandhi International Airport in Delhi, where the pilots of the different inbound flights talked about GPS spoofing as the reason for their landing. Spoofing is the process of sending counterfeit GPS signals which mislead the aircraft's navigation systems and may cause a wrong measure of the altitude, the position or the runway alignment. In Delhi, pilots operating under GPS-based landing procedures over Runway 10 experienced errors in their approaches and promptly switched to the alternative procedures without any delay.

The Minister said that apart from Delhi, other airports, viz. Kolkata, Amritsar, Mumbai, Hyderabad, Bengaluru, and Chennai were the 6 airports that recorded similar GNSS interference patterns consisting of both jamming and spoofing. Though no major interruptions or incidents occurred, these occurrences are a sign of a steady and enlarging threat.

‍

Why Is GPS Spoofing So Dangerous?

‍

Satellite navigation and communication systems are the backbone of modern aviation, which is now a matter of great precision. Signal jamming by malicious actors comes with a bunch of risks:

‍

1. Diversions and Delays: Pilots may be forced to either give up attempts to land or divert flights, which translates into higher consumption of fuel and more complicated operations due to the case of jamming.

2. Threat of Safety Issue: Pilots are trained to deal with such incidents by following the prescribed fallback procedures, but still they depend very much on the GNSS signals that are accurate for safe manoeuvring, especially in low visibility situations.

3. Pressure on Old Systems: Indian airports are still in the process of completely converting from ground-based navigation aids to GNSS. Signal disruptions entail the use of older technologies, which results in putting additional pressure on the already overburdened air traffic control systems.

4. Opening Up Possibilities for Direct Attacks: Signal jamming can be made a tool for more clever tactics of operation that can include causing confusion during the busy traffic period or performing coordinated attacks to create chaos.

‍

Aviation and Cyber Threats

‍

The disturbances that have been mentioned at the seven airports are not unique. The civil aviation regulators all over the world have already reported an increase in GNSS jamming. The exemplary cases in the Middle East, Eastern Europe, and East Asia have revealed that the safety of airspace has turned into a tactical issue.

Moreover, India's quick adoption of digital technology in the aviation sector could open threat vulnerabilities from state-sponsored groups, hackers. In this instance, the government has not yet announced who was responsible for the spoofing, but the trend points to an adversary with advanced technology.

‍

Government and Regulatory Response

‍

The confirmation from the Civil Aviation Minister underscores a proactive stance by agencies such as:

• Directorate General of Civil Aviation (DGCA)
• Ministry of Civil Aviation
• Airports Authority of India (AAI)

‍

The involved entities are collaborating now to do an inquiry into the cases and set up preventive measures. 

‍

The main steps that are taken in response are: 

‍

• More thorough observation of GNSS signal anomalies 
• More pilot briefings and training on dealing with spoofing situations 
• Improving navigation aids to set up a backup 
• Working with IT security experts to find out the sources of interference 
• Communicating with other global aviation authorities to share the best practices 

‍

India, being a significant player in the world aviation market, is not allowed to relax its guard. Cyberattacks on airports show how digital as well as physical security are becoming more and more intertwined.

‍

The Bigger Picture: Protecting Critical Infrastructure

‍

Aviation is a sector that very clearly shows that threats from cyberspace can easily translate into security issues for a nation. The airport system not only becomes more vulnerable to attacks but also the whole aviation industry as the digital ecosystems gain more complex forms together with integrated telecommunications networks, the Internet of Things (IoT)-enabled systems, and cloud-based services.

‍

One of the many threats in the form of GNSS spoofing demonstrates so-called: 

‍

• Ransomware attacks on airport systems
• Contamination of air traffic control infrastructure 
• Data breaches conducted by insiders 
• Passenger data attacks 
• Hinderance of airport logistics and baggage systems 

‍

What Needs to Happen Next?

‍

India is compelled to embrace a multi-faceted approach in order to manage the intricacies of GNSS interference risk:

‍

1. Cybersecurity Measures in Aviation Enforced: New monitoring tools, anomaly detection systems, and instant response plans will be put into service.
2. Redundant Technology: The non-GNSS-based navigation system will be expanded to guarantee the continuity of operations in the event of jamming.
3. Cyber Drills Across all Sectors: To get pilots, air traffic control personnel, and airport operators ready, the aviation cyber drills will be conducted at the national level.
4. Global Cooperation: International organisations will be approached to share the information and standardise the procedures.
5. R&D and Innovations: Funding will be directed towards anti-spoofing technology, stronger satellite signals, and the domestic navigation system, like NavIC.

‍

Conclusion

‍

The cyberattack that targeted the seven airports serves as a clear reminder that aviation cybersecurity should not be considered a secondary issue anymore. Even though the quick reaction from the authorities managed to averted any disruptions, the event still shows the vulnerabilities of modern aviation systems. India's air travel infrastructure expansion will be a good time for the country to install its strong cybersecurity frameworks to protect its passengers, maintain the continuity of operations, and secure the airspace of its territory. At CyberPeace, we believe that a coordinated, proactive, and technology-driven approach is no longer an option, it is the new fundamental of aviation security in the digital age.

‍

Reference

‍

• https://www.youtube.com/watch?v=8ZgAVgwQ5lE

‍