#FactCheck: AI-Manipulated Video Falsely Shows Ravish Kumar Criticising CJP, AAP Leaders

Executive Summary:

QakBot, a particular kind of banking trojan virus, is capable of stealing personal data, banking passwords, and session data from a user's computer. Since its first discovery in 2009, Qakbot has had substantial modifications.

C2 Server commands infected devices and receives stolen data, which is essentially the brain behind Qakbot's operations.Qakbot employs PEDLL (Communication Files), a malicious program, to interact with the server in order to accomplish its main goals. Sensitive data, including passwords or personal information, is taken from the victims and sent to the C2 server. Referrer files start the main line of communication between Qakbot and the C2 server, such as phishing papers or malware droppers. WHOIS data includes registration details for this server, which helps to identify its ownership or place of origin.

This report specifically focuses on the C2 server infrastructure located in India, shedding light on its architecture, communication patterns, and threat landscape.

Introduction:

QakBot is also known as Pinkslipbot, QuakBot, and QBot, capable of stealing personal data, banking passwords, and session data from a user's computer. Malware is bad since it spreads very quickly to other networks, affecting them like a worm.,It employs contemporary methods like web injection to eavesdrop on customer online banking interactions. Qakbot is a member of a kind of malware that has robust persistence techniques, which are said to be the most advanced in order to gain access to compromised computers for extended periods of time.
‍

Technical Analysis: 

The following IP addresses have been confirmed as active C2 servers supporting Qbot malware activity:

‍

Sample IP's

• 123.201.40[.]112
• 117.198.151[.]182
• 103.250.38[.]115
• 49.33.237[.]65
• 202.134.178[.]157
• 124.123.42[.]115
• 115.96.64[.]9
• 123.201.44[.]86
• 117.202.161[.]73
• 136.232.254[.]46

These servers have been operational in the past 14 days (report created in the month of Nov) and are being leveraged to perpetuate malicious activities globally.

URL/IP: 123.201.40[.]112

• inetnum: 123.201.32[.]0 - 123.201.47[.]255
• netname: YOUTELE
• descr: YOU Telecom India Pvt Ltd
• country: IN
• admin-c: HA348-AP
• tech-c: NI23-AP
• status: ASSIGNED NON-PORTABLE 
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-16T06:43:19Z
• mnt-irt: IRT-IN-YOU
• source: APNIC
• irt: IRT-IN-YOU
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• e-mail: abuse@youbroadband.co.in
• abuse-mailbox: abuse@youbroadband.co.in 
• admin-c: HA348-AP
• tech-c: NI23-AP
• auth: # Filtered
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:30:51Z
• source: APNIC
• person: Harindra Akbari
• nic-hdl: HA348-AP
• e-mail: harindra.akbari@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-10T11:01:47Z
• source: APNIC
• person: NOC IQARA
• nic-hdl: NI23-AP
• e-mail: network@youbroadband.co.in
• address: YOU Broadband India Limited
• address: 2nd Floor, Millennium Arcade
• address: Opp. Samarth Park, Adajan-Hazira Road
• address: Surat-395009,Gujarat
• address: India
• phone: +91-261-7113400
• fax-no: +91-261-2789501
• country: IN
• mnt-by: MAINT-IN-YOU
• last-modified: 2022-08-08T10:18:09Z
• source: APNIC
• route: 123.201.40.0/24
• descr: YOU Broadband & Cable India Ltd.
• origin: AS18207
• mnt-lower: MAINT-IN-YOU
• mnt-routes: MAINT-IN-YOU
• mnt-by: MAINT-IN-YOU
• last-modified: 2012-01-25T11:25:55Z
• source: APNIC

IP 123.201.40[.]112 uses the requested URL-path to make a GET request on the IP-address at port 80. "NOT RESPONDED" is the response status code for the request "C:\PROGRAM FILES GOOGLE CHROME APPLICATION CHROME.EXE" that was started by the process. 

Programs that retrieve their server data using a GET request are considered legitimate. The Google Chrome browser, a fully functional application widely used for web browsing, was used to make the actual request. It asks to get access to the server with IP 123.201.40[.]112 in order to collect its data and other resources. 

Malware uses GET requests to retrieve more commands or to send data back to the command and control servers. In this instance, it may be an attack server making the request to a known IP address with a known port number. Since the server has not replied to the request, the response status "NOT RESPONDED" may indicate that the activity was carried out with malicious intent.

This graph illustrates how the Qakbot virus operates and interacts with its C2 server, located in India and with the IP address 123.201.40[.]112. 

Impact

Qbot is a kind of malware that is typically distributed through hacked websites, malicious email attachments, and phishing operations. It targets private user information, including corporate logins or banking passwords. The deployment of ransomware: Payloads from organizations such as ProLock and Egregor ransomware are delivered by Qbot, a predecessor. Network Vulnerability: Within corporate networks, compromised systems will act as gateways for more lateral movement.

Proposed Recommendations for Mitigation

• Quick Action: To stop any incoming or outgoing traffic, the discovered IP addresses will be added to intrusion detection/prevention systems and firewalls.
• Network monitoring: Examining network log information for any attempts to get in touch with these IPs
• Email security: Give permission for anti-phishing programs.
• Endpoint Protection: To identify and stop Qbot infestations, update antivirus definitions.,Install tools for endpoint detection and response.
• Patch management: To reduce vulnerabilities that Qbot exploits, update all operating systems and software on a regular basis.
• Incident Response: Immediately isolate compromised computers.
• Awareness: Dissemination of this information to block the IP addresses of active C2 servers supporting Qbot malware activity has to be carried out.

Conclusion:

The discovery of these C2 servers reveals the growing danger scenario that Indian networks must contend with. To protect its infrastructure from future abuse, organizations are urged to act quickly and put the aforementioned precautions into place. 

Reference: 

• Threat Intelligence - ANY.RUN
• https://www.virustotal.com/gui
• https://www.virustotal.com/gui/ip-address/123.201.40.112/relations

‍

Introduction

Quantum technology involves the study of matter and energy at the sub-atomic level. This technology uses superposition and entanglement to provide new capabilities in computing, cryptography and communication and solves problems at speeds not possible with classical computers. Unlike classical bits, qubits can exist in a superposition of states, representing 0, 1, or any combination of these states simultaneously. The Union Cabinet approved the National Quantum Mission on 19 April 2023, with a budget allocation of Rs 6000 Crore. The mission will seed, nourish, and scale up scientific and industrial R&D in the domain of quantum technology so that India emerges as one of the leaders in developing quantum technologies and their applications. 

The Union Minister for Science and Technology and Minister of Earth Sciences, Dr. Jitendra Singh announced the selection of 8 start-ups for support under India’s National Quantum Mission and the National Mission on Interdisciplinary Cyber-Physical Systems (NM-ICPS). The selected start-ups represent diverse quantum tech domains and were chosen via a rigorous evaluation process. These startups are poised to be critical enablers in translating quantum research into practical applications. This start-up selection aligns with India’s broader vision for technological self-reliance and innovation by 2047. 

Policy Landscape and Vision

The National Quantum Mission’s main goal is to develop intermediate-scale quantum computers with 50-1000 physical qubits in 8 years, across diverse platforms such as superconducting and photonic technology. The mission deliverables include the development of satellite-based secure quantum communications between ground stations over a range of 2000 km within India, long-distance secure quantum communications with other countries, inter-city quantum key distribution over 2000 km, and multi-node quantum networks with quantum memories.

The National Mission on Interdisciplinary Cyber-Physical Systems aims to promote translational research in Cyber-Physical Systems and associated technologies and prototypes and demonstrates applications for national priorities. The other expectations are enhancing the top-of-the-line research base, human resource development and skill sets in these emerging areas. These missions align with India’s broader ideals such as the Digital India and Make in India campaigns to strengthen India’s technological ecosystem. 

Selected Startups and Their Innovations

The startups selected reflect alignment with India’s National Quantum Mission, oriented towards fostering cutting-edge research and innovation and have industrial applications aiming at placing India as the global leader in quantum technology. The selections are:

• QNu Labs (Bengaluru): is advancing quantum communication by developing end-to-end quantum-safe heterogeneous networks.
• QPiAI India Pvt. Ltd. (Bengaluru): is building a superconducting quantum computer.
• Dimira Technologies Pvt. Ltd. (IIT Mumbai):  is creating indigenous cryogenic cables, essential for quantum computing.
• Prenishq Pvt. Ltd. (IIT Delhi): developing precision diode-laser systems.
• QuPrayog Pvt. Ltd. (Pune): is working on creating optical atomic clocks and related technologies.
• Quanastra Pvt. Ltd. (Delhi): is developing advanced cryogenics and superconducting detectors.
• Pristine Diamonds Pvt. Ltd. (Ahmedabad): is creating diamond materials for quantum sensing.
• Quan2D Technologies Pvt. Ltd. (Bengaluru): is making advancements in superconducting Nanowire Single-photon Detectors.

References

• https://pib.gov.in/PressReleasePage.aspx?PRID=2077635 
• https://www.csis.org/analysis/quantum-technology-applications-and-implications ‍
• https://dst.gov.in/national-quantum-mission-nqm

Overview:

In today’s digital landscape, safeguarding personal data and communications is more crucial than ever. WhatsApp, as one of the world’s leading messaging platforms, consistently enhances its security features to protect user interactions, offering a seamless and private messaging experience

App Lock: Secure Access with Biometric Authentication

To fortify security at the device level, WhatsApp offers an app lock feature, enabling users to protect their app with biometric authentication such as fingerprint or Face ID. This feature ensures that only authorized users can access the app, adding an additional layer of protection to private conversations.

How to Enable App Lock:

1. Open WhatsApp and navigate to Settings.
2. Select Privacy.
3. Scroll down and tap App Lock.
4. Activate Fingerprint Lock or Face ID and follow the on-screen instructions.

Chat Lock: Restrict Access to Private Conversations

WhatsApp allows users to lock specific chats, moving them to a secured folder that requires biometric authentication or a passcode for access. This feature is ideal for safeguarding sensitive conversations from unauthorized viewing.

How to Lock a Chat:

1. Open WhatsApp and select the chat to be locked.
2. Tap on the three dots (Android) or More Options (iPhone).
3. Select Lock Chat
4. Enable the lock using Fingerprint or Face ID.

Privacy Checkup: Strengthening Security Preferences

The privacy checkup tool assists users in reviewing and customizing essential security settings. It provides guidance on adjusting visibility preferences, call security, and blocked contacts, ensuring a personalized and secure communication experience.

How to Run Privacy Checkup:

1. Open WhatsApp and navigate to Settings.
2. Tap Privacy.
3. Select Privacy Checkup and follow the prompts to adjust settings.

Automatic Blocking of Unknown Accounts and Messages

To combat spam and potential security threats, WhatsApp automatically restricts unknown accounts that send excessive messages. Users can also manually block or report suspicious contacts to further enhance security.

How to Manage Blocking of Unknown Accounts:

1. Open WhatsApp and go to Settings.
2. Select Privacy.
3. Tap to Advanced 
4. Enable Block unknown account messages

IP Address Protection in Calls

To prevent tracking and enhance privacy, WhatsApp provides an option to hide IP addresses during calls. When enabled, calls are routed through WhatsApp’s servers, preventing location exposure via direct connections.

How to Enable IP Address Protection in Calls:

1. Open WhatsApp and go to Settings.
2. Select Privacy, then tap Advanced.
3. Enable Protect IP Address in Calls. 

Disappearing Messages: Auto-Deleting Conversations

Disappearing messages help maintain confidentiality by automatically deleting sent messages after a predefined period—24 hours, 7 days, or 90 days. This feature is particularly beneficial for reducing digital footprints.

How to Enable Disappearing Messages:

1. Open the chat and tap the Chat Name.
2. Select Disappearing Messages.
3. Choose the preferred duration before messages disappear.

View Once: One-Time Access to Media Files

The ‘View Once’ feature ensures that shared photos and videos can only be viewed a single time before being automatically deleted, reducing the risk of unauthorized storage or redistribution.

How to Send View Once Media:

1. Open a chat and tap the attachment icon.
2. Choose Camera or Gallery to select media.
3. Tap the ‘1’ icon before sending the media file.

Group Privacy Controls: Manage Who Can Add You

WhatsApp provides users with the ability to control group invitations, preventing unwanted additions by unknown individuals. Users can restrict group invitations to ‘Everyone,’ ‘My Contacts,’ or ‘My Contacts Except…’ for enhanced privacy.

How to Adjust Group Privacy Settings:

1. Open WhatsApp and go to Settings.
2. Select Privacy and tap Groups.
3. Choose from the available options: Everyone, My Contacts, or My Contacts Except

‍

Conclusion

‍

WhatsApp continuously enhances its security features to protect user privacy and ensure safe communication. With tools like App Lock, Chat Lock, Privacy Checkup, IP Address Protection, and Disappearing Messages, users can safeguard their data and interactions. Features like View Once and Group Privacy Controls further enhance confidentiality. By enabling these settings, users can maintain a secure and private messaging experience, effectively reducing risks associated with unauthorized access, tracking, and digital footprints. Stay updated and leverage these features for enhanced security.

‍