#FactCheck -Claim That India’s GDP Was “Fake for 10 Years” is Misleading

Executive Summary

A video is being shared on social media with the claim that Ministry of External Affairs spokesperson Randhir Jaiswal was seen eating nuts during the BRICS Summit. The post claims that a reporter questioned him about eating nuts during the event. The video is also being shared with the sarcastic caption, “The Nutty Spokesperson.” Through the post, an attempt is being made to suggest that a reporter questioned Randhir Jaiswal about eating nuts during a press briefing. CyberPeace Research found that in the original video, Ministry of External Affairs spokesperson Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Jaish-e-Mohammed chief Masood Azhar. Jaiswal addressed the announcement during the regular media briefing held on September 15, 2026. In his response, Jaiswal said that such announcements by Pakistan were not new and that the country should take concrete action against terrorism. However, the video being circulated on social media has been digitally edited using the original footage to falsely suggest that a reporter had questioned Jaiswal about eating nuts.

‍

Claim:

‍

During the BRICS Summit, a reporter questioned Ministry of External Affairs spokesperson Randhir Jaiswal about eating nuts and confronted him over it.

https://x.com/PhophoOnDutyy/status/2099940769876640084?s=20 

https://archive.ph/lH7bg 

‍

‍

Fact Check

‍

To verify the claim, we conducted a Google search using relevant keywords. During the search, we did not find any credible media report supporting the claim.As part of our research, we conducted a reverse image search of keyframes from the video. We found the original video on the YouTube channel of the Ministry of External Affairs, India. In the original video, Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Masood Azhar.The reporter does not question Jaiswal about eating nuts anywhere in the original video. This establishes that the original footage has been edited and presented with a false context. Therefore, the claim being circulated on social media is false.

‍

https://www.youtube.com/live/dw-qqLolRgc 

‍

‍

As part of our further research, we checked the official X account of MEA FactCheck. It also identified the video as AI-generated.

https://x.com/MEAFactCheck/status/2100076244805255501?s=20 

‍

‍

The video was scanned using the AI detection tool Hive Moderation. According to the results, the video has a 55% probability of being AI-generated.

‍

‍

Conclusion

‍

Our research found that the video being shared on social media is fake and edited. In the original video, Ministry of External Affairs spokesperson Randhir Jaiswal was responding to a question about Pakistan’s announcement of a 7 million Pakistani rupee bounty on Masood Azhar.At no point in the original video does the reporter question Jaiswal about eating nuts. 

The footage being circulated has been digitally manipulated and presented in a different context. The official X account of MEA FactCheck also identified the video as AI-generated. Therefore, the claim that Jaiswal was questioned by a reporter about eating nuts is false and misleading.

‍

Introduction

‍

In today’s cybersecurity landscape, ransomware has emerged as one of the most significant and rapidly growing cyber threats. What began as attacks carried out by individual hackers has evolved into a highly organised criminal enterprise, with groups operating through structured business models and global networks. The emergence of The Gentlemen ransomware group reflects this transformation, demonstrating how modern threat actors can quickly expand their operations and target organisations across multiple sectors. Their rise highlights the increasing sophistication of ransomware campaigns and the growing challenges faced by organisations in defending against them. The attribution of the group's administrator to an identified individual in Izhevsk, Russia, provides a valuable lens through which to examine three interconnected developments: the maturation of ransomware-as-a-service (RaaS) business models, the inherent operational security (OPSEC) weaknesses that emerge over the course of cybercriminal careers, and the geopolitical environments that enable such actors to operate with relative impunity. Together, these dynamics illustrate the industrialisation of modern cybercrime.

‍

The Industrialisation of Ransomware-as-a-Service

‍

The remarkable rapid rise of The Gentlemen is impossible without discussing the maturation of ransomware-as-a-service (RaaS). RaaS systems utilize network intrusion experts as affiliates who conduct networks intrusions and secure access in exchange for a cut of the total ransoms paid, while a core group builds and maintains the ransomware framework itself. Although Reveton, one of the earliest Raas providers, can be credited with bringing early iterations of RaaS to fruition in 2012, the potential scale was truly evident in the mid-2020s. By 2025 it was estimated that there were over 100 active ransomware gangs operating; this proliferation is the direct result of the franchise-like system, which has lowered the barriers to entry for cybercrime. 

The marketplace surrounding RaaS is intensely competitive, and this is clearly exemplified in the business structure of The Gentlemen: while many of the top ransomware groups provide an 80/20 profit share (with the majority of the profit going to the affiliates), The Gentlemen has an exceptionally profitable 90/10 split (affiliates keep 90% of the profit share) for affiliates, likely to draw experienced operators away from their rivals given recent decreases in victim willingness to pay and corresponding increases in the incentives RaaS platforms are required to offer. 

The operational efficiency of the group is representative of a successful enterprise. They attack vulnerable internet-facing VPNs and firewalls and generally complete the network encryption within a matter of hours, leaving defenders with very little time to respond, as confirmed by Check Point Software, a renowned cybersecurity vendor.

Additionally, PRODAFT reports that the administrator of The Gentlemen, known by the alias Zeta88 (previously known as Hastalamuerte), directly provides affiliates with SSL VPN credentials, often obtained through brutal force attacks or their own private leaked databases, indicating an unusually high level of vertical integration for RaaS groups.

‍

AI as a Force Multiplier in Ransomware Development

‍

A particularly significant aspect of the Hastalamuerte case is PRODAFT's finding that the administrator employs artificial intelligence to develop and maintain ransomware, support associated tooling, and assist post-exploitation operations. This reflects a broader trend observed across the 2025–2026 threat landscape, where AI has increasingly lowered the capability threshold for participation in organised cybercrime. Researchers have documented its role in automating stages of intrusion, accelerating malware development cycles, and simplifying the maintenance of malicious infrastructure. These capabilities have been leveraged by both nation-state actors and criminal enterprises.

The trajectory of Hastalamuerte is especially illustrative. Cybersecurity Forum posts during 2019-2020 depict a hacker who is fairly novice at fundamental penetration testing procedures. A subsequent emergence as the operator of a top-tier ransomware-as-a-service operation indicates that AI-assisted development may be responsible for dramatically reducing the skill level and time necessary to create a successful criminal enterprise in cyberspace. The evolution of these tools should make the route from novice forum user to accomplished ransomware operator more attainable for a wider array of perpetrators in the future.

‍

The OPSEC Paradox: How Cybercriminals Leave a Trail

‍

The attribution of Hastalamuerte's identity by researchers from Intel 471, Flashpoint, and Constella Intelligence demonstrates the effectiveness of modern open-source and commercial intelligence methodologies. A forum registration traceable to an IP address from Izhevsk, Russia linked a Protonmail address, which linked to an Apple account, a GitHub profile, a Telegram handle, a Russian phone number, and finally to a 36 year old marketing professional named Alexander Andreevich Yapaev who was also living in Izhevsk. Investigators did not use an advanced capability in their attribution, but rather a simple OPSEC mistake of consistently reusing credentials. Every username and email address and every phone number creates a linkage between disparate data points, eventually building into a real-world persona. 

It has also come out in the forum discussion that while training for a penetration testing course in 2020, Hastalamuerte displayed the kind of inexperience that a novice would display in traceable, recorded fashion to intelligence databases. It's an example of a broader rule about attribution; attacker mistakes provide the most value. With Russians the lack of apparent consequences may contribute to a lack of need to maintain tight OPSEC from the start.

‍

The Russian Safe Haven: Conditional Impunity and Its Limits

‍

Yapaev's base in Izhevsk is emblematic of the geostrategic situation that has allowed Russian cybercriminality to prosper. Security researchers routinely label Russia's policy as one of "controlled impunity," where the cybercriminality directed at foreign entities is ignored or implicitly condoned, while that directed at Russian interests will prompt a law enforcement response. This constitutes what has been called a "managed market" rather than an "unconditional sanctuary," where many of the named defendants could and likely will continue their illegal enterprise with little fear of reprisal, provided that they do not threaten the interests of the Russian state and do not attempt to move their operations outside of Russian control.

Yet this protection is neither absolute nor permanent. In May 2024, the transnational Operation Endgame campaign highlighted the growing global appetite for damaging the cybercrime ecosystem rooted in Russia. Russian authorities did indeed pursue and seize some assets and operators, but arrests seem largely confined to the lower-rung facilitators of these attacks (hosting providers and payment services), and it seems higher-end ransomware operators continue to evade scrutiny. Selective enforcement thus further bolsters the perception that protection is accorded according to strategic value, not legal standards. For operators such as Hastalamuerte, who possess no publicly documented intelligence connections, growing attribution capabilities, and sustained international pressure may gradually erode the security traditionally associated with operating from within Russia.

‍

Attribution as a Deterrence Instrument

‍

The public identification of Alexander Andreevich Yapaev as Hastalamuerte/Zeta88 shows the continued struggle with the utility of attribution in situations where immediate prosecution is not feasible. Its utility is far more extensive than simply an ability to make an arrest. Functionally, public naming forces a perpetrator into an open evidentiary space and can lead to alterations in their operational habits and effectiveness. Strategically, attribution provides future leverage for sanctions, indictments, financial restrictions, or extradition if the target can leave their safe haven country. The logic behind US rewards programs (paying up to $10 million for the capture and conviction of ransomware operators) relies on this principle. The analytical insight provided by the case cannot be understated either. Hastalamuerte's trajectory from a relative amateur forum participant on Nulled and Raidforums in 2019 to leading a significant ransomware operation by 2026 offers an invaluable look into the career progression of a cyber criminal. It confirms one of the lessons learned through deterrence and attribution: pseudonymity is not everlasting, and many years of OPSEC failures can be pieced together to establish a real-world identity.

‍

Conclusion

‍

The Gentlemen incident is emblematic of the three broad themes that currently characterise cyber warfare: ransomware-as-a-service through innovative competition, common OPSEC failures that enable attribution, and a new, conditional regime of protection for Russian cybercriminals. The obvious defense lesson: increasing attack surfaces require stronger identity, behavioural monitoring, and intelligence capacities. The policy lesson: effective attribution is still an essential tool for comprehension, deterrence, and disruption in an increasingly industrialised environment of criminals supporting each other's operations in ransomware-as-a-service.

‍

References

‍

1. https://krebsonsecurity.com/2026/06/who-runs-the-ransomware-group-the-gentlemen/
2. https://www.recordedfuture.com/
3. https://www.vectra.ai/topics/ransomware-as-a-service
4. https://www.trmlabs.com/es/resources/blog/new-disruption-opportunities-in-the-evolving-ransomware-ecosystem

‍

Executive Summary

‍
A video purportedly showing former Chief of Defence Staff (CDS) General Anil Chauhan criticizing the government over “Operation Sindoor” is being widely shared on social media. In the viral clip, Chauhan is allegedly heard saying that the Indian military was unable to complete the operation due to political interference and that, unlike Pakistan’s military, India’s armed forces did not receive adequate political support. Users claim that he made these remarks while announcing his resignation.

CyberPeace Research Wing research found the claim to be false. The viral video is a deepfake created by manipulating an original video of General Chauhan’s farewell ceremony at the end of his tenure. In the authentic footage, the former CDS expressed satisfaction with his tenure and thanked the three armed services for their support. The altered clip appears to have been shared with the intention of spreading misinformation. Similar AI-manipulated videos targeting senior Indian military officials have surfaced on social media in the past.

‍

Claim

‍

On June 1, 2026, Facebook user “Meenu Kundu Dhakal” shared the viral video with the caption: “The army is facing political interference. The government has turned the armed forces into a tool for gathering votes.”

‍

https://www.facebook.com/100092961600658/posts/1669160500794363/

https://perma.cc/SE6J-5JC6

‍

‍

Fact Check

‍

To verify the claim, we extracted keyframes from the viral video and conducted reverse-image searches. The original video was found on the official Instagram account of ANI, where it was posted on May 30, 2026. In the authentic footage, General Chauhan says:“I thank the three services and Headquarters IDS for it. With the conclusion of the guard of honour, I bid farewell to my colleagues in uniform, comrades in arms forever. I just laid the wreath at the War Memorial for the last time in uniform, as a humble tribute to those who laid down their lives in the line of duty. After the wreath-laying, I was welcomed by friends, relatives, and well-wishers. This is symbolic of my transition from uniform to civilian life. I had a very satisfying and excellent tenure. Thank you. Jai Hind.”

‍

https://www.instagram.com/reels/DY8-5sqgF1B/

‍

‍

The same footage was also found on multiple news platforms covering General Chauhan’s farewell ceremony upon completion of his tenure. None of the reports mentioned any criticism of the government or comments regarding political interference in military affairs.

https://www.youtube.com/shorts/J-Fi8F32huo 

‍

‍

To assess whether the viral clip had been manipulated, we analyzed the audio using AI-detection tools. The tool “Hiya” indicated a 51 percent likelihood that the audio was AI-generated. 

‍

‍

Another detection tool, “Undetectable,” found indicators suggesting a 44 percent probability of AI-generated audio content.

‍

‍

Conclusion

‍

The viral video claiming to show former CDS General Anil Chauhan criticizing the government’s handling of “Operation Sindoor” is a deepfake. The original video was recorded during his farewell ceremony at the conclusion of his tenure. In the authentic footage, General Chauhan described his tenure as “very satisfying and excellent” and thanked the armed forces for their support. The viral clip has been digitally manipulated and is being shared to spread misinformation.

‍