#FactCheck: Fake Claim that US has used Indian Airspace to attack Iran

In the tapestry of our modern digital ecosystem, a silent, pervasive conflict simmers beneath the surface, where the quest for cyber resilience seems Sisyphean at times. It is in this interconnected cyber dance that the obscure orchestrator, StripedFly, emerges as the maestro of stealth and disruption, spinning a complex, mostly unseen web of digital discord. StripedFly is not some abstract concept; it represents a continual battle against the invisible forces that threaten the sanctity of our digital domain.

This saga of StripedFly is not a tale of mere coincidence or fleeting concern. It is emblematic of a fundamental struggle that defines the era of interconnected technology—a struggle that is both unyielding and unforgiving in its scope. Over the past half-decade, StripedFly has slithered its way into over a million devices, creating a clandestine symphony of cybersecurity breaches, data theft, and unintentional complicity in its agenda. Let's delve deep into this grand odyssey to unravel the odious intricacies of StripedFly and assess the reverberations felt across our collective pursuit of cyber harmony.

The StripedFly malware represents the epitome of a digital chameleon, a master of cyber camouflage, masquerading as a mundane cryptocurrency miner while quietly plotting the grand symphony of digital bedlam. Its deceptive sophistication has effortlessly skirted around the conventional tripwires laid by our cybersecurity guardians for years. The Russian cybersecurity giant Kaspersky's encounter with StripedFly in 2017 brought this ghostly figure into the spotlight—hitherto, a phantom whistling past the digital graveyard of past threats.

How Does it work 

Distinctive in its composition, StripedFly conceals within its modular framework the potential for vast infiltration—an exploitation toolkit designed to puncture the fortifications of both Linux and Windows systems. In an emboldened maneuver, it utilizes a customized version of the EternalBlue SMBv1 exploit—a technique notoriously linked to the enigmatic Equation Group. Through such nefarious channels, StripedFly not only deploys its malicious code but also tenaciously downloads binary files and executes PowerShell scripts with a sinister adeptness unbeknownst to its victims.

Despite its insidious nature, perhaps its most diabolical trait lies in its array of plugin-like functions. It's capable of exfiltrating sensitive information, erasing its tracks, and uninstalling itself with almost supernatural alacrity, leaving behind a vacuous space where once tangible evidence of its existence resided.

In the intricate chess game of cyber threats, StripedFly plays the long game, prioritizing persistence over temporary havoc. Its tactics are calculated—the meticulous disabling of SMBv1 on compromised hosts, the insidious utilization of pilfered keys to propagate itself across networks via SMB and SSH protocols, and the creation of task scheduler entries on Windows systems or employing various methods to assert its nefarious influence within Linux environments.

The Enigma around the Malware

This dualistic entity couples its espionage with monetary gain, downloading a Monero cryptocurrency miner and utilizing the shadowy veils of DNS over HTTPS (DoH) to camouflage its command and control pool servers. This intricate masquerade serves as a cunning, albeit elaborate, smokescreen, lulling security mechanisms into complacency and blind spots.

StripedFly goes above and beyond in its quest to minimize its digital footprint. Not only does it store its components as encrypted data on code repository platforms, deftly dispersed among the likes of Bitbucket, GitHub, and GitLab, but it also harbors a bespoke, efficient TOR client to communicate with its cloistered C2 server out of sight and reach in the labyrinthine depths of the TOR network.

One might speculate on the genesis of this advanced persistent threat—its nuanced approach to invasion, its parallels to EternalBlue, and the artistic flare that permeates its coding style suggest a sophisticated architect. Indeed, the suggestion of an APT actor at the helm of StripedFly invites a cascade of questions concerning the ultimate objectives of such a refined, enduring campaign.

How to deal with it 

To those who stand guard in our ever-shifting cyber landscape, the narrative of StripedFly is a clarion call. StObjective reminders of the trench warfare we engage in to preserve the oasis of digital peace within a desert of relentless threats. The StripedFly chronicle stands as a persistent, looming testament to the necessity for heeding the sirens of vigilance and precaution in cyber practice.

Reaffirmation is essential in our quest to demystify the shadows cast by StripedFly, as it punctuates the critical mission to nurture a more impregnable digital habitat. Awareness and dedication propel us forward—the acquisition of knowledge regarding emerging threats, the diligent updating and patching of our systems, and the fortification of robust, multilayered defenses are keystones in our architecture of cyber defense. Together, in concert and collaboration, we stand a better chance of shielding our digital frontier from the dim recesses where threats like StripedFly lurk, patiently awaiting their moment to strike.

References:

https://thehackernews.com/2023/11/stripedfly-malware-operated-unnoticed.html?m=1

‍

Introduction

Social media platforms serve as an ideal breeding ground for cybercrime. A new fraud called ‘WhatsApp Pink’ has emerged, promising new features and an improved UI. Several law enforcement and government agencies have already issued severe caution against the program, which is used to hack mobile phones and steal personal information.

What is a pink WhatsApp Scam?

WhatsApp is on a roll with new features, but the messaging app is also experiencing an increase in a new type of scam. The WhatsApp Pink scam, as it is known, is gaining steam. Police and government organisations in several states, including Mumbai, Kerala, and Karnataka, have warned about the scam. A North Region cybercrime wing tweet warned, “WHATSAPP PINK – A Red Alert for Android Users.” The government’s cybersecurity organisations have warned about the rise in pink WhatsApp scams.

Scammers and hackers target WhatsApp users with fake messages via the network in this scam. According to reports, the message contains a link directing users to download WhatsApp Pink, a bogus messaging program. According to sources, scammers are targeting many people with the promise that the next version will have a better interface and additional features.

The application also steals critical financial information such as OTP, bank account information, and contact information. When people open the link, harmful software is installed on their mobile phones, and scammers get access to the phones. The user may even lose access to their phone by downloading the app.

According to the advisory

The news about ‘New Pink Look WhatsApp with extra features’ recently circulating among WhatsApp users is a hoax that can lead to hacking of your mobile through malicious software.” It is uncommon for fraudsters to devise new tricks and methods to entice naive consumers into falling into their trap and committing cyber fraud. It is the users’ responsibility to be Aware, Alert, and Attentive to these types of frauds in order to be safe and secure in the digital world.”

The link that is present in the message, according to a notice from the police, is a phishing effort. By clicking the link, the user runs the risk of having their device compromised, which might allow scammers to steal their device information or use it without their permission.

Users run the possibility of suffering negative outcomes if they click the Pink WhatsApp link, as the Mumbai Police have warned. These dangers include financial loss, identity theft, spam attacks, unauthorised access to contact information and saved images, and even total loss of control over mobile devices.

Guidelines against the Scam

• If a user has installed the fake WhatsApp, the authorities have instructed that they uninstall it immediately by going into the mobile settings, selecting WhatsApp with the pink logo in Apps, and then uninstalling it.
• Users have been advised to exercise caution when clicking links from untrustworthy websites unless they have previously verified their legitimacy. Users are advised to only download and update software from reliable sites such as the official Google Play Store, the iOS App Store, and so on.
• individuals using the site have been told not to send any links or communications to other persons until they have received proper authentication or verification.
• To avoid misuse, users are advised not to disclose any personal or financial information, including passwords, login information, and credit or debit card information, to anybody online. Furthermore, in order to defend themselves against fraud attempts, users are encouraged to stay up to date on the most recent news and changes in order to be informed and careful about cybercriminal activities.

Why do Scammer target WhatsApp

WhatsApp is the world’s most popular messaging service; it can reach out to considerably more prospective victims than it could with another tool. A scammer’s victims are almost certainly using WhatsApp. If all their victims are in one app, the criminal can easily handle their activities.

Conclusion

WhatsApp users may reduce their chances of being victims of the pink WhatsApp scam significantly by following the guidelines issued by the advisory. WhatsApp has become the primary target for scams, as there is a large number of the population using WhatsApp so it will be easy for the Scammer to steal critical personal information and target another victim through WhatsApp. The pink WhatsApp Scam is exactly like it.

Executive Summary:

A viral claim circulating on social media suggests that the Indian government is offering a 50% subsidy on tractor purchases under the so-called "Kisan Tractor Yojana." However, our research reveals that the website promoting this scheme, allegedly under the Ministry of Agriculture and Farmers Welfare, is misleading. This report aims to inform readers about the deceptive nature of this claim and emphasize the importance of safeguarding personal information against fraudulent schemes.

‍

‍

Claim:

A website has been circulating misleading information, claiming that the Indian government is offering a 50% subsidy on tractor purchases under the so-called "Kisan Tractor Yojana." Additionally, a YouTube video promoting this scheme suggests that individuals can apply by submitting certain documents and paying a small, supposedly refundable application fee. 

‍

‍

Fact Check: 

‍

Our research has confirmed that there is no scheme by the Government of India named 'PM Kisan Tractor Yojana.' The circulating announcement is false and appears to be an attempt to defraud farmers through fraudulent means.

While the government does provide various agricultural subsidies under recognized schemes such as the PM Kisan Samman Nidhi and the Sub-Mission on Agricultural Mechanization (SMAM), no such initiative under the name 'PM Kisan Tractor Yojana' exists. This misleading claim is, therefore, a phishing attempt aimed at deceiving farmers and unlawfully collecting their personal or financial information.

Farmers and stakeholders are advised to rely only on official government sources for scheme-related information and to exercise caution against such deceptive practices.

To assess the authenticity of the “PM Kisan Tractor Yojana” claim, we reviewed the websites farmertractoryojana.in and tractoryojana.in. Our analysis revealed several inconsistencies, indicating that these websites are fraudulent.

As part of our verification process, we evaluated tractoryojana.in using Scam Detector to determine its trustworthiness. The results showed a low trust score, raising concerns about its legitimacy. Similarly, we conducted the same check for farmertractoryojana.in, which also appeared untrustworthy and risky. The detailed results of these assessments are attached below.

Given that these websites falsely present themselves as government-backed initiatives, our findings strongly suggest that they are part of a fraudulent scheme designed to mislead and exploit individuals seeking genuine agricultural subsidies.

‍

‍

During our research, we examined the "How it Works" section of the website, which outlines the application process for the alleged “PM Kisan Tractor Yojana.” Notably, applicants are required to pay a refundable application fee to proceed with their registration. It is important to emphasize that no legitimate government subsidy program requires applicants to pay a refundable application fee.

‍

‍

Our research found that the address listed on the website, “69A, Hanuman Road, Vile Parle East, Mumbai 400057,” is not associated with any government office or agricultural subsidy program. This further confirms the website’s fraudulent nature. Farmers should verify subsidy programs through official government sources to avoid scams.

‍

‍

A key inconsistency is the absence of a verified social media presence. Most legitimate government programs maintain official social media accounts for updates and communication. However, these websites fail to provide any such official handles, further casting doubt on their authenticity.

‍

‍

Upon attempting to log in, both websites redirect to the same page, suggesting they may be operated by the same entity or individual. This further raises concerns about their legitimacy and reinforces the likelihood of fraudulent activity.

‍

‍

Conclusion:

Our research confirms that the "PM Kisan Tractor Yojana" claim is fraudulent. No such government scheme exists, and the websites promoting it exhibit multiple red flags, including low trust scores, a misleading application process requiring a refundable fee, a false address, and the absence of an official social media presence. Additionally, both websites redirect to the same page, suggesting they are operated by the same entity. Farmers are advised to rely on official government sources to avoid falling victim to such scams.

• Claim: PM-Kisan Tractor Yojana Government Offering Subsidy on tractors.
• Claimed On: Social Media
• Fact Check:  False and Misleading 

‍

‍