#FactCheck- Viral video of burning ship falsely linked to US attack on vessel carrying Indian nationals in Oman waters

Introduction

‍

On June 2nd, 2026, even as thousands of Class 12 students across the nation flocked to submit re-evaluation and verification applications on the CBSE’s newly rolled-out On-Screen Marking (OSM) portal, a decidedly different kind of visitor had logged in an attacker carrying automation scripts, botnet traffic, and malicious intentions to either shut the system down or steal its contents. The attack, which CBSE then openly reported on its official X account, flooded the portal with 1.5 million hits in two minutes and sent over a lakh unauthorized file access attempts.

‍

Understanding the Attack Architecture: The Two-Pronged Operation

‍

The CBSE cyberattack was actually not a single exploit but rather a layered, orchestrated attack. The attack can be understood in two prongs:

‍

1. The DoS Attack:Firstly, attackers initiated a large-scale DoS (Denial of Service) attack, producing approximately 1.5 million requests in 120 seconds, or approximately 12,500 per second, in order to saturate the server. By overloading the systems with bogus requests, the attackers sought not just to disable the site but also to throw off security personnel from their primary task of stabilizing the portal during its launch period.

‍

The File Probing: These attacks usually include the following methods:

‍

1. Path Traversal Attacks - Attackers will attempt to navigate outside of the current directory by supplying inputs such as "../../etc/passwd" in URL parameters or in a file upload. 
2. Forced Browsing / Directory Enumeration - An attacker may have used tools to attempt to find vulnerable files and directories like answer sheets, exam scans, student identification documents, and admin-related files by systematically guessing names.
3. API Endpoint Fuzzing: If any REST or GraphQL API was present for the portal, the attacker may have tried sending a various number of inputs to parameters to attempt to retrieve records, find IDORs, or escalate privileges. 
4. Session Token Harvesting - For high-load environments, some systems may use insecure session management. Attackers would attempt to predict or guess the token to hijack another student's or administrator's session.

‍

‍

Why Are Educational Portals High-Value Targets?

‍

Here's why the Indian education sector is an attractive target for cyber-attacks:

‍

1. Concentrated PII: Millions of students are present on these education portals, and their data (names, birth dates, Aadhaar linkage information, parents' details, address, education profiles, etc.) is of the highest value on the dark web and can be used for identity theft, financial fraud, credential reuse, and targeting.
2. Low Investment Relative to the Data Value: The education system is chronically under-invested in cybersecurity. Many of these systems were built for a function/scale, rather than security by design, and are highly vulnerable.
3. High-Pressure Launches: Launching a massive, public-facing system like the CBSE OSM verification site that needs to service millions of students on day 1 often requires time constraints that preclude proper penetration testing, stress testing, security auditing, or staged deployment; these launches often launch with numerous known security flaws.
4. Large Attack Surface: The education ecosystem is comprised of many integrated systems, APIs, cloud instances, third-party systems, and authentication infrastructure. Each dependency increases the overall attack surface and provides multiple potential avenues to compromise these systems, such as IDOR, API abuse, or credential-based attacks.
5. Geopolitical Motivation: Following the Op Sindoor attack in 2025, there was a significant increase in public institutions targeted by cyber-attacks with prolonged DDoS against critical systems. Highly visible, public-facing student portals catering to more than 35 million students make a tantalizing target for both nation-state attackers and hacktivist groups to cause disruption or gather intelligence.

‍

The CBSE's Response

‍

A balanced perspective on CBSE's public response is necessary:

‍

1. The portal did not go down and served about 14000 users at any point during the attack and had over 28000 successful submissions by 10pm June 2nd.
2. In real-time, sessions are continuously being optimized for the students, and session timeouts are being extended.
3. Management was on top of the situation and maintained good communication through social media.

‍

To withstand a sustained attack volume of roughly 12,500 requests per second, CBSE would surely need more than one security control implemented on its infrastructure. In all probability, rate limiting was the primary reason it could sustain this attack volume by limiting the requests from an IP or client over a certain period of time and automatically aborting requests from systems sending automated data. This, coupled with perhaps load balancing, will distribute the attack across several systems, none of which will have become bottlenecks. Finally, it is possible that traffic could have also been routed via a Content Delivery System (CDN) or dedicated DDoS mitigation service capable of detecting and cleaning requests of malicious code before they even reach the origin servers.

‍

Technical Recommendations

‍

It is not sustainable for India's exam infrastructure to continue operating in a post-breach, patching-in mode forever. The systems need to embrace Privacy By Design (PBD) as an integral part of their DNA. Here are suggestions for short-term hardening and long-term resilience:

1. Deploy a zero-trust file access architecture: Each request to access any file should be authenticated, authorized using role-based access control (RBAC), and logged in an immutable audit trail. Direct access to file paths should not be permissible; rather, pre-signed, time-limited tokens are recommended to control file access.
2. Implement a multi-layered DDoS mitigation architecture: A combination of network edge traffic scrubbing (CDNs & DDoS mitigation services) along with rate limiting at the application layer via WAF is necessary. An Anycast-based multi-PoP architecture and pre-provisioning scrubbing capacity may further increase resiliency
3. Conduct pre-launch penetration testing and red teaming exercises: Penetration testing with OWASP Top 10 audits, API security reviews, and load-based penetration testing should be conducted by CERT-In empanelled auditors prior to the launch of the examination. The red team exercise should simulate blended DoS and file-probing attacks.
4. Secure Payments: The secure payment surface should support PCI-DSS Level 1 certified payments and tokenisation and employ velocity checks against automated abuse and support 3D Secure 2.0 (3DS2) on card payments.
5. Implement SOC: Security operations centers (SOCs) should have real-time access to CERT-In threat feeds and ISAC intelligence, allowing them to act quickly on emerging attack vectors before anything malicious can be exploited.
6. Encryption: Students' data should be encrypted with AES-256; keys should be stored separately in a Hardware Security Module (HSM) system and not co-located with the data storage system. Student data must also support the data minimisation principle, while storing it should be encrypted with AES-256 and keys should be stored securely in HSM.
7. Monitoring: 24/7 SOC monitoring, ongoing vulnerability scanning on all pipelines, anomalous detection baselining, and frequent tabletop exercises for cyber resilience at 24x7 and post-examination activities.

‍

Beyond the Breach: Governance, Accountability, and the Growing Cyber Threat to India's Education Sector

‍

The CBSE attack is merely one example of a wider truth, a truth that extends beyond an isolated security event and highlights security as not only an issue of governance but of national security. Although it was during a period in which there was considerable change in leadership within the CBSE (some officials had been removed from their positions), and although it may be impossible to prevent administrative change, security vulnerability is an inherent risk when it cannot be ensured that the new incumbents have had knowledge transferred from the previous administration in terms of system design, vendor management, configuration, and incident response procedures. It has become apparent that a requirement for digital system governance must be considered to be just as serious a requirement as an academic and administrative governance requirement.

The attack is also indicative of a wider problem, and in 2025 there were in excess of 265 million cyber-attacks, and increasingly, critical infrastructure is being attacked by all manner of actors, including criminals, hacktivists, and state-sponsored groups. Educational institutions offer a prime target due to the amount of personal data held within their systems and the historically low security investment they tend to have. Worldwide trends that support the similar narrative of "data of immense value protected by under-resourced programs" (universities hit by ransomware and mass student data breaches included) are being constantly illustrated. For an examining body of tens of millions of students, cybersecurity cannot be an afterthought and needs to be clearly addressed within the governance and risk-management framework of the institution and, therefore, become a fundamental pillar of public trust.

‍

Conclusion

‍

The June 2026 cyberattack on the CBSE's OSM portal both illustrated the advancing capabilities of today's threat actors and highlighted the critical role cyber resilience must play in India's education sector. A high-volume DoS attack combined with over 100,000 file access attempts indicates a concerted and strategic operation both for disruption and the opportunity for data theft. Though the CBSE's infrastructure did hold, the attack should not offer comfort. Educational institutions are responsible for a significant amount of sensitive personal data, and they are major targets to state-sponsored and financially motivated attackers. Attacks are bound to continue. It is essential that cybersecurity become a fundamental pillar of the governance and trustworthiness of education and not a technical afterthought.

‍

References

‍

1. CBSE Official Statement on Cyberattack, X (formerly Twitter), @cbseindia29, June 2, 2026.
2. Indian Express, "CBSE OSM Row: Portal attack was a 'coordinated, two-pronged operation' says cybersecurity expert," June 3, 2026.
3. Srinivas L, Joint MD & Joint CEO, 63SATS Cybertech (subsidiary of 63 moons technologies limited), was quoted in Indian Express, June 3, 2026.
4. The Federal, "CBSE re-evaluation portal faces cyberattack, records 1.5 million hits in two minutes," June 2, 2026. https://thefederal.com
5. CERT-In (Indian Computer Emergency Response Team), Empanelled Security Auditor Framework. https://www.cert-in.org.in
6. OWASP Top 10 Web Application Security Risks, 2021 edition. https://owasp.org/www-project-top-ten/
7. National Institute of Standards and Technology (NIST), Zero Trust Architecture (SP 800-207), August 2020. https://doi.org/10.6028/NIST.SP.800-207
8. Indian Express, "What CBSE ignored: Its own panel found glitches in dry run, said delay OSM by a year," June 3, 2026.
9. Asianet Newsable, "CBSE Class 12 re-evaluation portal withstands major DoS cyberattack," June 2, 2026. https://newsable.asianetnews.com

Introduction

‍

‍"Artificial Intelligence may be the new charlatan in town"

‍

There is something almost wonderfully Indian about our current relationship with artificial intelligence. We are simultaneously afraid of it, fascinated by it, regulating it, funding it, using it and occasionally asking it to write the regulation meant to control it. In contrast, artificial intelligence seems to have figured out the oldest trick in the book: create an issue and then figure out how to solve it. Both the deepfake and the deepfake detector can be produced by it. It has the ability to  both generate and detect false information. It can both authenticate and mimic your voice. It can create a fake image and determine if it is fake. The machine ,in other words, is increasingly becoming both the burglar and the security system. We now refer to this as innovation.  Perhaps nothing better captures this peculiar moment than India’s most recent regulatory actions. The government has strengthened regulations pertaining to synthetic content such as requiring labelling and expediting the removal of illegal AI-generated information. After a legitimate government or court order, platforms are expected to take action within three hours, significantly reducing the removal window for some content. It took years for the internet to become ubiquitous. There are  now three hours for the law to become transitory. This is the first great paradox of AI governance. Technology operates at the speed of creation. Law operates at the speed of procedure. The citizen is seated between the two. 

‍

The Age of the Digital Double

‍

Indian courts are already dealing with this issue in more tangible ways. Cricket player Yuvraj Singh recently received relief from the Delhi High Court in a personality-rights case involving deepfakes created by AI and unlawful use of his identity. Courts have intervened against AI-generated and modified content in similar cases involving other public individuals. As a result, the law faces an odd dilemma: What exactly belongs to a person?  In the past, humans used comparatively stable identifiers to understand identity, such as a name, portrait, signature, or voice. That simplicity has been disrupted by AI. You can now detach your face from your body. You may separate your throat from your voice. It is possible to distinguish between your emotions and your expressions. It is possible to fabricate your political beliefs without engaging in politics. The legitimacy of a person's existence is being requested to be protected by the law, not just their property which is a far more difficult issue.

‍

When Artificial Intelligence Enters the Courtroom

‍

The irony becomes richer when AI enters the courtroom itself. Courts are creating guidelines for the use of  AI in the courtroom, just as they are being challenged to decide what happens when AI creates reality outside of it. Human primacy, accountability, transparency, data protection and judicial independence are highlighted in the Supreme Court’s proposed rules on the use of AI in courts. After all, there is one situation in which the justification that “the AI said so” should never be accepted. A hallucinated judgment is more than just a mistake in technology. It may turn into a mistake of authority in a legal system. A precedent can be confidently created by a machine. It can be cited with confidence by a lawyer and maybe then brought before a court for consideration.  All of a sudden, we have created a flawless little bureaucratic ecology where everyone has been duped despite no one's intention to do so. It's not inevitable that machines will turn malevolent, but rather that people will grow unduly reliant on machines that seem authoritative.

‍

The Great AI Contradiction

‍

We asked, "What can AI do?" for years.What can AI do for us, we then enquired? We are starting to wonder what AI might do to humans. The following query ought to be more challenging: When it does, who is at fault? Because AI systems don't cleanly fit into the legal frames we inherited, that question becomes very challenging. Developers, model providers, data providers, deployers, platforms, and end users are among them. There may occasionally be a middleman. There is a victim occasionally. Surprisingly, there can occasionally be multiple roles at once. This point is made in a recent working paper on AI and consumer rights in India: while current consumer protection laws may apply to AI harms, the conventional division of accountability among manufacturers, sellers, and service providers becomes challenging when AI systems involve a much more dispersed value chain.

‍

The Misunderstanding on AI’s Intelligence

‍

This is the point at which our sense for policy sometimes fails. We are concerned that AI will develop superintelligence. The more imminent threat can be much less dramatic. It is not necessary for AI to surpass human intelligence in order to wreak great harm. All it needs to do is become more convincing, quicker, and less expensive than human verification. Artificial general intelligence is not necessary for a fraudster to con an elderly person. A supercomputer is not necessary for a political manipulator to create a candidate's voice. A stalker can create an intimate deepfake without being conscious. A pupil can file a hallucinated case citation without the assistance of a robot attorney. Ordinary human wrongdoing magnified by incredible technical magnitude is what it is.

‍

The Real Test of AI Governance

‍

The number of standards we create, the number of committees we form, or the number of compliance boxes platforms check will not ultimately determine the success of AI regulation. Something considerably simpler will be used to measure it. Can the legal system advise a regular citizen where to go, what to do, and who will be held accountable when an AI system impersonates, defrauds, surveils, manipulates, or denies them a service?

The presence of accountability following failure, not the absence of failure.

Sometimes the most advanced piece of technology in the room is still an old-fashioned institution: a law that works, a regulator that responds, a court that understands the technology and a human being willing to take responsibility. Because if AI is going to be both the fire and the fire extinguisher, we should at least make sure that someone other than the machine owns the building.

‍

References

‍

• https://economictimes.indiatimes.com/news/india/government-tightens-deepfake-rules-mandates-ai-content-labels-and-three-hour-takedown-timeline/articleshow/133011656.cms?utm_source=chatgpt.com&from=mdr 
• https://theleaflet.in/law-and-technology/explained-the-supreme-court-of-indias-draft-regulations-for-use-of-artificial-intelligence-in-courts-2026 
• https://www.bananaip.com/intellepedia/yuvraj-singh-personality-rights-ai-deepfakes-delhi-high-court/

‍

Executive Summary

‍

Prime Minister Narendra Modi recently appealed to citizens to reduce the consumption of gold and edible oil for a year. He also urged people to conserve petrol, diesel, and cooking gas amid the crisis arising from the ongoing tensions in West Asia involving the United States, Israel, and Iran. Amid this backdrop, a purported image of Union Home Minister Amit Shah and his son Jay Shah, who currently serves as Chairman of the International Cricket Council, has gone viral on social media. The image shows them seated inside a chartered aircraft along with two other individuals. Several social media users shared the picture as genuine while targeting the central government and Amit Shah.

However, CyberPeace Research Wing reseach found that the viral image is fake and was generated using Artificial Intelligence (AI).

‍

Claim

‍

An Instagram user named “Om Prakash Shukla” shared the viral image on May 24, 2026, with the caption:“People are sacrificing their desires for the nation, while they are enjoying luxury.”

https://www.instagram.com/p/DYuFqnmCh7T

‍

‍

Fact Check

‍

To verify the authenticity of the viral image, we conducted a Google Lens search. However, the image was not found on any credible news platform, which raised suspicion about its authenticity. We also performed keyword-based searches related to the image using Google Search, but found no authentic reports or media coverage associated with the picture.

Further reseach involved analysing the image using AI detection tools. We first examined the picture using the “Sight Engine” AI detection tool, which indicated a 99 percent probability that the image was AI-generated.

‍

‍

We also tested the image using another AI detection platform called “TruthScan.” This tool likewise suggested, with around 97 percent probability, that the image had been created using artificial intelligence

‍

‍

Conclusion

‍

The reseach found that the viral image featuring Union Home Minister Amit Shah and ICC Chairman Jay Shah inside a chartered aircraft is AI-generated. The image was digitally created using AI tools, and the viral claim associated with it is false.

‍