#FactCheck: Viral Deepfake Video of Modi, Shah, Jaishankar Apologize for Operation Sindoor Blunder

Introduction

US President Biden takes a step by signing a key executive order to manage the risks posed by AI. The new presidential order on Artificial intelligence (AI) sets rules on the rapidly growing technology that has big potential but also covers risks. The presidential order was signed on 30th October 2023. It is a strong action that the US president has taken on AI safety and security. This order will require the developers to work on the most powerful AI model to share their safety test results with the government before releasing their product to the public. It also includes developing standards for ethically using AI and for detecting AI-generated content and labelling it as such. Tackling the many dangers of AI as it rapidly advances, the technology poses certain risks by replacing human workers, spreading misinformation and stealing people's data. The white house is also making clear that this is not just America’s problem and that the US needs to work with the world to set standards here and to ensure the responsible use of AI. The white house is also urging Congress to do more and pass comprehensive privacy legislation. The order includes new safety guidelines for AI developers, standards to disclose AI-generated content and requirements for federal agencies that are utilising AI. The white house says that it is the strongest action that any government has taken on AI safety and security. In the most recent events, India has reported the biggest ever data breach, where data of 815 million Indians has been leaked. ICMR is the Indian Council of Medical Research and is the imperial medical research institution of India. 

Key highlights of the presidential order

The presidential order requires developers to share safety test results. It focuses on developing standards, tools & tests to ensure safe AI. It will ensure protection from AI-enabled frauds and protect Americans' privacy, advance equity and civil rights, stand up for consumers and workers, promote innovation and competition, protect against risks of using AI to engineer dangerous material and provide guidelines for detecting AI -AI-generated content and establishing overall standards for AI safety and security.

Online content authentication and labelling 

Biden administration has asked the Department of Commerce to set guidelines to help authenticate content coming from the government, meaning the American people should be able to trust official documents coming from the government. So, focusing on content authentication, they have also talked about labelling AI-generated content, making the differentiation between a real authentic piece of content and something that has been manipulated or generated using AI. 

ICMR Breach

On 31/10/2023, an American intelligence and cybersecurity agency flagged the biggest-ever data breach, putting the data of 81.5 crore Indians at stake and at at potential risk of making its way to the dark market. The cyber agency has informed that a ‘threat actor’, also known as  ‘pwn001’ shared a thread on Breach Forums, which is essentially claimed as the ‘premier Databreach discussion and leaks forum’. The forum confirms a breach of 81.5 crore Indians. As of today,, ICRM has not issued any official statement, but it has informed the government that the prestigious Central Bureau of Investigation (CBI) will be taking on the investigation and apprehending the cybercriminals behind the cyber attack. The bad actor’s alias, 'pwn001,' made a post on X (formerly Twitter); the post informed that Aadhaar and passport information, along with personal data such as names, phone numbers, and addresses. It is claimed that the data was extracted from the COVID-19 test details of citizens registered with ICMR. This poses a serious threat to the Indian Netizen from any form of cybercrime from anywhere in the world. 

Conclusion:

The US presidential order on AI is a move towards making Artificial intelligence safe and secure. This is a major step by the Biden administration, which is going to protect both Americans and the world from the considerable dangers of AI.  The presidential order requires developing standards, tools, and tests to ensure AI safety. The US administration will work with allies and global partners, including India, to develop a strong international framework to govern the development and use of AI. It will ensure the responsible use of AI. With the passing of legislation such as the Digital Personal Data Protection Act, 2023, it is pertinent that the Indian government works towards creating precautionary and preventive measures to protect Indian data. As the evolution of cyber laws is coming along, we need to keep an eye on emerging technologies and update/amend our digital routines and hygienes to stay safe and secure. 

References:

• https://m.dailyhunt.in/news/india/english/lokmattimes+english-epaper-lokmaten/biden+signs+landmark+executive+order+to+manage+ai+risks-newsid-n551950866?sm=Y
• https://www.hindustantimes.com/technology/in-indias-biggest-data-breach-personal-information-of-81-5-crore-people-leaked-101698719306335-amp.html?utm_campaign=fullarticle&utm_medium=referral&utm_source=inshorts

‍

‍

Introduction

We are living in the digital age, where from ordering food to floating into a relationship everything is preferred to be digitized. It has been quite evident that in the past few years, online dating has become immensely popular due to its potential success stories. Since it has become a medium to find potential partners. Among the string of successes and pros of online dating, there seems to be a corner which is curtained that contains scams and treachery. A very recent case in Delhi puts light into the dark side of online dating where a 25-year-old journalist was trapped in an online dating scam. It portrays the threat of meeting an unknown person through an online dating app and how a person gets involved in the vicious cycle. Since the concept of online dating is all about meeting a new person and getting indulged. This incident talks about a man who met a woman through a dating app Bumble and got scammed for Rs 15000.

Unveiling the scam

It started like a fairy tale where a 25-year-old Delhi resident met with a girl on a dating app Bumble, where they spoke and found each other compatible. Followed by it the girl approaches the boy to meet at a specific restaurant situated in Delhi. The boy was away from the idea that the first meetup would turn into a nightmare which horrifying experience he would share on social media. It is not only about the financial loss but also about the emotional distress one goes through. Every coin has two sides and when surfing in the digital world one needs to keep in mind that along with the pros, there are certain cons. In the eagerness to meet someone, we should not lose our presence of mind. Continuing the incident once both reached the specified restaurant the girl made an order of various food items including beverages, shots of vodka, glasses of wine, different cuisines and hookah. Which not so surprisingly culminated in an inflated bill of Rs 15,886. After paying the hefty amount the boy went to the washroom once he came back the bill vanished followed by the girl being eager to leave the place. Till that very moment, the victim was in his dreamland where he did not get the hint that he had been scammed. Once he reached home and tried contacting the lady her account was deleted from the platform and was not reachable through calls. This incident shook the victim and pushed him to melancholy. Since he did not expect this to happen. Devastated by the fraud and treachery the man wrote about his disappointing experience on his Twitter handle addressing Delhi police to look into this.

It has been brought to the notice that similar incidents have been reported in the past as well. The trend remains the same in which the culprit insists the victim meet at a specific location decided by them, it is done with such conviction that it becomes difficult for the victim to deny. Once they accept to meet in the decided location it is followed by making the victim order expensive food and alcohol and at the time of payment giving excuses or pretending to pay. Once the payment is done the culprit rushes to leave the location or disappears without any head up. Not to be perplexed once they leave they will not leave any trace of them.

How to stay safe in the online dating world?

Online dating can bring butterflies in the stomach, and indeed it is a beautiful experience to meet someone new and fall in love but with this beauty, there comes the baggage of falling into the trap of cyber scams. While surfing online dating sites one needs to be very careful and vigilant since the highlighted incidents are relevant enough to showcase the negative impact on it.

Best practices

• Use reliable platforms:  With the growing digitalization, there are infinite platforms available for online dating. But here is the catch one needs to be very finicky in choosing an appropriate platform among the countless options. It is best to use authentic platforms or apps and read reviews and ratings before installing any such applications or platforms.
• Cross-verify the profiles:  Once you receive a profile compatible enough to talk about it is recommended to have elaborative conversations. It is not about doubting someone but being calculative and cross-checking all the information given. Before meeting the person it is best to have a detailed conversation but not reveal much about you.
• Have control in your pocket: When it comes to paying the bill be proactive in dividing the bill. It is advisable to do so that the liability of paying a hefty bill does not come from one party. This will make sure that even if one of the people has the intention to exploit the other person they will become alarmed. 
• Go with the flow: Since meeting an unknown person is all flowery and spontaneous, it is also good to follow your instinct and go with the flow if you find anything weird during the conversation or while in person. It is advisable to back off or to leave the place as soon as possible.
• Be cautious in sharing your personal information with strangers: While conversing with an unknown person online, it is very important to keep a hold on our emotions and not share any personal information which can be misused by cyber crooks. Also, it is very important that we do not discuss anything about our financial capabilities and transactions.  It is imperative to note that cyber crooks exploit the many new ways to commit online fraud by targeting innocent individuals. 
• Catching up in public places: When meeting for the first time it is advisable to meet a person in a public place such as a park, museums etc. It is the best way to avoid going to a place decided or being insisted. Since meeting in a public place gives a sense of security that people are around you.
• Keep your near people in Loop: No matter how private you are while meeting an unknown person keep your friends and near one aware of it. 

What to do if you fall into such dating scams

1. While one can be emotionally drained, it is very important to keep track of all the information shared, save all your messages, take pictures of the scammer's profile and document every small detail which can be relevant.
2. Report on the platform:  There would be a section called “Contact us” or “Report” on the platform where you can report against the scammer.  Most dating apps have this section where you can mention your issue so that they can take action against such profiles.
3. National Cyber Crime Reporting Portal, 1930 Helpline: The Cybercrime reporting portal http://www.cybercrime.gov.in/ equipped with 24x7 helpline 1930 is a powerful resource available to the victims of cybercrimes to report their cases. 

Conclusion

Online dating can become the gush of winds for someone but it is very important to keep in mind that with the potential of falling in love, there comes a threat of being trapped and getting into cyber frauds or scams. So many cases are being reported, and the recent case also highlights that not everyone on online sites is genuine. So be aware of such scams and stay informed and safe in the evolving digital environment. 

References

• https://www.moneycontrol.com/news/trends/delhi-cafes-hiring-girls-to-scam-customers-says-bumble-user-conned-out-of-rs-15000-11724701.html
• https://www.ndtv.com/delhi-news/delhi-man-falls-victim-to-scam-as-bumble-date-costs-him-15-000-4566680/amp/1
• https://services.india.gov.in/service/detail/national-cyber-crime-reporting-portal#:~:text=This%20portal%20is%20an%20initiative,crimes%20against%20women%20and%20children.

‍

Executive Summary:

In late 2024 an Indian healthcare provider experienced a severe cybersecurity attack that demonstrated how powerful AI ransomware is. This blog discusses the background to the attack, how it took place and the effects it caused (both medical and financial), how organisations reacted, and the final result of it all, stressing on possible dangers in the healthcare industry with a lack of sufficiently adequate cybersecurity measures in place. The incident also interrupted the normal functioning of business and explained the possible economic and image losses from cyber threats. Other technical results of the study also provide more evidence and analysis of the advanced AI malware and best practices for defending against them. 

1. Introduction

The integration of artificial intelligence (AI) in cybersecurity has revolutionised both defence mechanisms and the strategies employed by cybercriminals. AI-powered attacks, particularly ransomware, have become increasingly sophisticated, posing significant threats to various sectors, including healthcare. This report delves into a case study of an AI-powered ransomware attack on a prominent Indian healthcare provider in 2024, analysing the attack's execution, impact, and the subsequent response, along with key technical findings.

2. Background 

 In late 2024, a leading healthcare organisation in India which is involved in the research and development of AI techniques fell prey to a ransomware attack that was AI driven to get the most out of it. With many businesses today relying on data especially in the healthcare industry that requires real-time operations, health care has become the favourite of cyber criminals. AI aided attackers were able to cause far more detailed and damaging attack that severely affected the operation of the provider whilst jeopardising the safety of the patient information.  

 3. Attack Execution 

The attack began with the launch of a phishing email designed to target a hospital administrator. They received an email with an infected attachment which when clicked in some cases injected the AI enabled ransomware into the hospitals network. AI incorporated ransomware was not as blasé as traditional ransomware, which sends copies to anyone, this studied the hospital’s IT network. First, it focused and targeted important systems which involved implementation of encryption such as the electronic health records and the billing departments. 

The fact that the malware had an AI feature allowed it to learn and adjust its way of propagation in the network, and prioritise the encryption of most valuable data. This accuracy did not only increase the possibility of the potential ransom demand but also it allowed reducing the risks of the possibility of early discovery. 

 4. Impact 

•  The consequences of the attack were immediate and severe: The consequences of the attack were immediate and severe.
•  Operational Disruption: The centralization of important systems made the hospital cease its functionality through the acts of encrypting the respective components. Operations such as surgeries, routine medical procedures and admitting of patients were slowed or in some cases referred to other hospitals. 
•  Data Security: Electronic patient records and associated billing data became off-limit because of the vulnerability of patient confidentiality. The danger of data loss was on the verge of becoming permanent, much to the concern of both the healthcare provider and its patients. 
•  Financial Loss: The attackers asked for 100 crore Indian rupees (approximately 12 USD million) for the decryption key. Despite the hospital not paying for it, there were certain losses that include the operational loss due to the server being down, loss incurred by the patients who were affected in one way or the other, loss incurred in responding to such an incident and the loss due to bad reputation. 

5. Response

As soon as the hotel’s management was informed about the presence of ransomware, its IT department joined forces with cybersecurity professionals and local police. The team decided not to pay the ransom and instead recover the systems from backup. Despite the fact that this was an ethically and strategically correct decision, it was not without some challenges. Reconstruction was gradual, and certain elements of the patients’ records were permanently erased. 

 In order to avoid such attacks in the future, the healthcare provider put into force several organisational and technical actions such as network isolation and increase of cybersecurity measures. Even so, the attack revealed serious breaches in the provider’s IT systems security measures and protocols. 

6. Outcome

The attack had far-reaching consequences:

• Financial Impact: A healthcare provider suffers a lot of crashes in its reckoning due to substantial service disruption as well as bolstering cybersecurity and compensating patients. 
•  Reputational Damage: The leakage of the data had a potential of causing a complete loss of confidence from patients and the public this affecting the reputation of the provider. This, of course, had an effect on patient care, and ultimately resulted in long-term effects on revenue as patients were retained. 
•  Industry Awareness: The breakthrough fed discussions across the country on how to improve cybersecurity provisions in the healthcare industry. It woke up the other care providers to review and improve their cyber defence status. 

7. Technical Findings

The AI-powered ransomware attack on the healthcare provider revealed several technical vulnerabilities and provided insights into the sophisticated mechanisms employed by the attackers. These findings highlight the evolving threat landscape and the importance of advanced cybersecurity measures.

7.1 Phishing Vector and Initial Penetration

• Sophisticated Phishing Tactics: The phishing email was crafted with precision, utilising AI to mimic the communication style of trusted contacts within the organisation. The email bypassed standard email filters, indicating a high level of customization and adaptation, likely due to AI-driven analysis of previous successful phishing attempts.
• Exploitation of Human Error: The phishing email targeted an administrative user with access to critical systems, exploiting the lack of stringent access controls and user awareness. The successful penetration into the network highlighted the need for multi-factor authentication (MFA) and continuous training on identifying phishing attempts.

7.2 AI-Driven Malware Behavior

• Dynamic Network Mapping: Once inside the network, the AI-powered malware executed a sophisticated mapping of the hospital's IT infrastructure. Using machine learning algorithms, the malware identified the most critical systems—such as Electronic Health Records (EHR) and the billing system—prioritising them for encryption. This dynamic mapping capability allowed the malware to maximise damage while minimising its footprint, delaying detection.
• Adaptive Encryption Techniques: The malware employed adaptive encryption techniques, adjusting its encryption strategy based on the system's response. For instance, if it detected attempts to isolate the network or initiate backup protocols, it accelerated the encryption process or targeted backup systems directly, demonstrating an ability to anticipate and counteract defensive measures.
• Evasive Tactics: The ransomware utilised advanced evasion tactics, such as polymorphic code and anti-forensic features, to avoid detection by traditional antivirus software and security monitoring tools. The AI component allowed the malware to alter its code and behaviour in real time, making signature-based detection methods ineffective.

7.3 Vulnerability Exploitation

• Weaknesses in Network Segmentation: The hospital’s network was insufficiently segmented, allowing the ransomware to spread rapidly across various departments. The malware exploited this lack of segmentation to access critical systems that should have been isolated from each other, indicating the need for stronger network architecture and micro-segmentation.
• Inadequate Patch Management: The attackers exploited unpatched vulnerabilities in the hospital’s IT infrastructure, particularly within outdated software used for managing patient records and billing. The failure to apply timely patches allowed the ransomware to penetrate and escalate privileges within the network, underlining the importance of rigorous patch management policies.

7.4 Data Recovery and Backup Failures

• Inaccessible Backups: The malware specifically targeted backup servers, encrypting them alongside primary systems. This revealed weaknesses in the backup strategy, including the lack of offline or immutable backups that could have been used for recovery. The healthcare provider’s reliance on connected backups left them vulnerable to such targeted attacks.
• Slow Recovery Process: The restoration of systems from backups was hindered by the sheer volume of encrypted data and the complexity of the hospital’s IT environment. The investigation found that the backups were not regularly tested for integrity and completeness, resulting in partial data loss and extended downtime during recovery.

7.5 Incident Response and Containment

• Delayed Detection and Response: The initial response was delayed due to the sophisticated nature of the attack, with traditional security measures failing to identify the ransomware until significant damage had occurred. The AI-powered malware’s ability to adapt and camouflage its activities contributed to this delay, highlighting the need for AI-enhanced detection and response tools.
• Forensic Analysis Challenges: The anti-forensic capabilities of the malware, including log wiping and data obfuscation, complicated the post-incident forensic analysis. Investigators had to rely on advanced techniques, such as memory forensics and machine learning-based anomaly detection, to trace the malware’s activities and identify the attack vector.

8. Recommendations Based on Technical Findings

To prevent similar incidents, the following measures are recommended:

1. AI-Powered Threat Detection: Implement AI-driven threat detection systems capable of identifying and responding to AI-powered attacks in real time. These systems should include behavioural analysis, anomaly detection, and machine learning models trained on diverse datasets.
2. Enhanced Backup Strategies: Develop a more resilient backup strategy that includes offline, air-gapped, or immutable backups. Regularly test backup systems to ensure they can be restored quickly and effectively in the event of a ransomware attack.
3. Strengthened Network Segmentation: Re-architect the network with robust segmentation and micro-segmentation to limit the spread of malware. Critical systems should be isolated, and access should be tightly controlled and monitored.
4. Regular Vulnerability Assessments: Conduct frequent vulnerability assessments and patch management audits to ensure all systems are up to date. Implement automated patch management tools where possible to reduce the window of exposure to known vulnerabilities.
5. Advanced Phishing Defences: Deploy AI-powered anti-phishing tools that can detect and block sophisticated phishing attempts. Train staff regularly on the latest phishing tactics, including how to recognize AI-generated phishing emails.

9. Conclusion

The AI empowered ransomware attack on the Indian healthcare provider in 2024 makes it clear that the threat of advanced cyber attacks has grown in the healthcare facilities. Sophisticated technical brief outlines the steps used by hackers hence underlining the importance of ongoing active and strong security. This event is a stark message to all about the importance of not only remaining alert and implementing strong investments in cybersecurity but also embarking on the formulation of measures on how best to counter such incidents with limited harm. AI is now being used by cybercriminals to increase the effectiveness of the attacks they make and it is now high time all healthcare organisations ensure that their crucial systems and data are well protected from such attacks.

‍