The collaboration between the Unique Identification Authority of India and the National Forensic Sciences University marks a significant development in India's security landscape and digital forensics. In a move aimed at strengthening the country’s digital infrastructure, UIDAI and NFSU have formalized a five-year partnership to advance research, training, and operational capabilities in cybersecurity and digital forensics. 

According to an official statement, UIDAI and NFSU have established a structured collaboration designed to address emerging challenges in cybersecurity and digital forensics.

UIDAI and NFSU Join Forces on Cybersecurity and Digital Forensics

The agreement, announced on May 5 in Ahmedabad, provides a comprehensive framework to bring together expertise from both institutions. It is intended to reinforce cyber resilience across UIDAI’s systems, which form the backbone of India’s digital identity ecosystem.  The Ministry of Electronics and Information Technology highlighted that this partnership creates an umbrella structure for coordinated efforts in research, technical development, and capacity building. The initiative underscores the growing importance of cybersecurity and digital forensics as critical components of national digital infrastructure. 

Six Strategic Pillars Driving UIDAI and NFSU Collaboration 

The UIDAI and NFSU partnership is structured around six key pillars, each targeting specific aspects of cybersecurity and digital forensics. These include academic and professional development, aimed at building skilled talent in the field, as well as strengthening information security and system integrity within UIDAI’s ecosystem.  Another major focus area is the development of advanced forensic infrastructure and laboratory capabilities. This will support deeper investigation and analysis of cyber incidents. Additionally, the agreement outlines provisions for technical support in cybersecurity operations, ensuring that UIDAI benefits from NFSU’s specialized expertise.  The collaboration also emphasizes joint research and technical advisory in emerging technologies. Areas such as artificial intelligence, blockchain, cryptography, and deepfake detection are expected to play a central role. The sixth pillar focuses on strategic placement and outreach, creating pathways for NFSU students to gain hands-on experience and career opportunities within UIDAI-related projects. 

Strengthening India’s Digital Backbone

India’s digital identity framework, powered by UIDAI, requires continuous upgrades to counter evolving cyber threats. The UIDAI and NFSU partnership aims to address this need by integrating advanced cybersecurity and digital forensics practices into the system’s core operations. UIDAI Chief Executive Officer Vivek Chandra Verma described the agreement as a crucial step toward enhancing the security architecture of India’s digital public infrastructure. He stated that the collaboration will significantly improve forensic readiness and resilience, ensuring stronger protection against cyber risks. The signing ceremony was attended by senior officials from both institutions, including Deputy Director General Abhishek Kumar Singh and NFSU Gujarat Campus Director S. O. Junare. Their presence highlighted the institutional commitment to advancing cybersecurity and digital forensics through sustained collaboration. 

Expanding Access While Enhancing Security 

Alongside this partnership, UIDAI has also taken steps to improve accessibility to its services. Collaborations with digital platforms like MapmyIndia and Google now allow users to locate authorized Aadhaar centers more easily. These platforms provide information on available services, operating hours, and accessibility features. While these initiatives focus on user convenience, they also align with the broader objective of strengthening the integrity of India’s digital identity system. By combining improved accessibility with robust cybersecurity and digital forensics measures, UIDAI aims to maintain trust in its infrastructure.

The post Tax Audit Trap: Silver Fox Unleashes “ABCDoor” via Modified Rust Loaders appeared first on Daily CyberSecurity.

New GoGra Linux malware linked to Harvester APT targets systems in South Asia, using fake PDFs and Microsoft APIs for covert command and control.

The post The Lotus Evolves: Mustang Panda Targets Indian Banks in a New Espionage Pivot appeared first on Daily CyberSecurity.

Acronis reveals Mustang Panda is using an updated version of LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works.

This article is the result of a collaboration with Indian media outlet Newslaundry. You can find Newslaundry’s editorially independent coverage here.

Indian companies have shipped more than 320 million synthetic opioid pills to West Africa – where they have not been approved by regulators – over the past three years, a Bellingcat investigation has found.

Export records from trade data provider 52wmb show that more than 1,400 consignments of tapentadol worth almost USD $130 million were sent from India to West Africa between January 2023 and December 2025.

Tapentadol, a painkiller two to three times more potent than tramadol, has not been approved for use in most West African countries, where some nations are grappling with an escalating opioid abuse epidemic.

However, this investigation shows that dozens of Indian suppliers have flooded the region with tapentadol over the past three years. Where dosages were listed, more than half the pills were in powerful strengths of 200mg or more – dosages that are not even approved in India.

The exports, cross-checked against records provided by trade data aggregator ImportGenius, show most tapentadol pills sent between 2023 and 2025 had the coastal nations of Sierra Leone and Ghana listed as their declared destinations.

The two West African countries were collectively marked as the destination for more than 80 per cent of the total value of tapentadol sent to the region.

Experts have documented how drug traffickers adapt quickly to international regulations and law enforcement efforts. In 2018, India tightened export controls around the opioid tramadol, one of the most trafficked synthetic drugs to West Africa.

In 2021, the International Narcotics Control Board (INCB) said large-scale tapentadol trafficking had been identified, particularly in consignments destined for Africa. It had previously noted that India’s strengthened tramadol controls could lead traffickers to substitute the drug with other potent synthetic opioids.

A BBC investigation last year revealed that Indian company Aveo Pharmaceuticals was illegally exporting tablets containing a mix of tapentadol and the muscle relaxant carisoprodol to West Africa. This led India’s drug regulator, the Central Drugs Standard Control Organisation (CDSCO), to ban the manufacture and export of all combinations of the two drugs.

Bellingcat’s investigation, in collaboration with Indian publishing partner Newslaundry, reveals that the supply of tapentadol pills from India to West Africa has surged in recent years.

Export data from 52wmb shows the value of tapentadol sent to the region has risen from about USD $27 million in the three year period from 2020 to 2022, to almost USD $130 million from 2023 to 2025.

Julius Maada Bio, Sierra Leone’s president, in 2024 declared a national emergency over rampant drug abuse and branded kush – a toxic blend of psychoactive substances including cannabis and synthetic opioids – a “death trap”.

Authorities in Sierra Leone have intercepted illegal tapentadol, including last July when the National Revenue Authority (NRA) said it thwarted a smuggling operation near its north-west border with Guinea.

The NRA and other agencies including the Transnational Organised Crime Unit, National Drug Law Enforcement Agency, and the Pharmacy Board of Sierra Leone did not respond to Bellingcat’s requests for comment.

Ghana’s Narcotics Control Commission (NACOC) said the illegal importation of tapentadol was first recorded in 2022 after international efforts to curb the tramadol crisis resulted in criminal networks shifting production to other pharmaceutical opioids including tapentadol, tafrodol and carisoprodol.

The agency has recorded a “steady rise” in tapentadol trafficking over the past three years, with authorities seizing more than 3.7 million tablets (250mg strength). Most were traced back to India, it said.

“NACOC investigations confirm that the bulk of tapentadol is trafficked into Ghana through seaports and by air, via express courier services,” a spokesperson said. “At the ports, the drug is concealed in containerized cargo falsely declared as pharmaceuticals, electrical materials or household goods. Express courier services are used for smaller, high-value quantities, often packed alongside legitimate consignments to avoid detection.”

NACOC said Ghana had emerged as both a destination and transit hub for tapentadol, with the majority of intercepted consignments bound for Niger, Mali, Burkina Faso and Nigeria. When sold domestically, it said the street drug was promoted as a tramadol substitute.

Ghana’s Food and Drugs Authority (FDA) said last year that the abuse of pharmaceutical opioids such as tapentadol — commonly known on the street as “Red” — was on the rise.

The FDA told Bellingcat it had “never issued any permit” for the manufacture or importation of tapentadol, in any strength, to any importer or to any country. It said any tapentadol shipments to Ghana were for “trans-shipment to neighbouring country”.

Import data for Ghana shows that no tapentadol entered the country between 2023 and 2025, which supports NACOC’s position that the drugs are being concealed and falsely declared. Import data for Sierra Leone was not available through 52wmb.

India’s drug and pharmaceutical exports have grown to more than $30 billion a year, according to the Pharmaceuticals Export Promotion Council of India (Pharmexcil), a division of the ministry of commerce and industry.

While tapentadol is available in India on prescription in strengths of up to 100mg (immediate release) and 200mg (extended release), authorities are aware of its risk of misuse. Last year, the Indian drug regulator’s Technical Advisory Board said the Department of Revenue may be requested to schedule the painkiller under the Narcotic Drugs and Psychotropic Substances Act, which would tighten rules around its export.

To export pharmaceutical products at strengths that are not approved in India, exporters are required to obtain an export “no objection certificate” (NOC) from the CDSCO, for which they have to submit proof of the drug’s approval in the importing country. Publicly available information shows tapentadol is not approved for use in any of the West African nations identified as part of this investigation.

The CDSCO did not respond to questions from Bellingcat or our publishing partner, Newslaundry.

In response to “Right to Information” requests submitted by Newslaundry, the CDSCO said only two companies had been granted authorisation to manufacture tapentadol for export between 2019 and 2024. However, the trade data analysed by Bellingcat did not list either company as an exporter of tapentadol to West Africa.

The CDSCO also said it had issued export NOCs for tapentadol to 51 companies since 2024, but that these were not for export to West African countries.

Meanwhile, Bellingcat’s analysis of trade data shows that more than 60 Indian suppliers have exported tapentadol to West Africa since 2023. The exporters are mostly pharmaceutical companies but also include smaller operations, such as one company owned by a Nigerian man who sent more than US $4 million of tapentadol to Niger and Ghana.

Dinesh Thakur, co-author of the book Truth Pill, told Newslaundry there were gaps in India’s drug regulatory framework that made it possible for potentially unsafe medicines to be manufactured and exported without proper oversight.

“There is no regulatory framework which checks a genuine importer and counterfeit importer between countries,” said Thakur, a former pharmaceutical executive who now works as a public health activist.

Mohammed Adinoyi Usman, a consultant anaesthetist at Rasheed Shekoni Federal University Teaching Hospital in Nigeria, said tackling Africa’s opioid crisis was complicated by a lack of resources across the region, weak government responses, and inaction by law enforcement agencies.

He said more collaboration and intelligence sharing was needed, especially across West African countries, to combat the problem. “We see so many opioids coming into our region because of a range of factors including under-funded institutions like customs and drug agencies, weak border controls and corruption,” he said.

“Africa is different. Even southern Africa is different from western Africa – each region has its peculiarities. In Nigeria, we don’t have well-functioning institutions to help control it. But our government is trying.”

Dr Usman said access to prescription opioids in Africa was inadequate, and pointed to research showing the disparity in distribution of legal opioids to low-income countries compared to high-income nations that consume the bulk of the world’s pain relief medication. He said opioid abuse was linked to crime and negative health outcomes.

“Sadly, access to prescription opioids is very limited in Africa,” Dr Usman said, “but the costs of illegal use are high.”

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Painkiller Pipeline: 300 Million Tapentadol Pills Sent from India to West Africa appeared first on bellingcat.

The video posted by a state branch of India’s ruling Bharatiya Janata Party (BJP) showed Assam chief minister Himanta Biswa Sarma shooting an image of two men in Muslim skull caps. “Foreigner-free Assam”, read one caption across the video. “Why did you not go to Pakistan?” said another. 

One of the men in the photo that Sarma was portrayed as shooting was Gaurav Gogoi, a leader of the Indian National Congress (INC), the BJP’s main competitor in Assam for the state’s upcoming legislative elections next month. 

Gogoi has stated that he is Hindu but enjoys visiting different religious sites and observing their norms. He has been photographed wearing traditional Muslim attire during religious occasions such as Eid. 

But the image of him in the video shared by BJP Assam, wearing a casual singlet with a skull cap, was not one of those occasions. 

Bellingcat has seen several dozen videos posted by the BJP that use generative artificial intelligence (AI) alongside anti-Muslim and anti-Bangladeshi messaging in the border states of Assam and West Bengal in December last year, ahead of legislative elections scheduled in both states for April.

Bellingcat analysed 499 social media posts containing photos and videos shared on Facebook, Instagram and X by the BJP’s official accounts in the two states for this time period, finding 194 posts that appeared to meet the United Nations’ definition of hate speech: discriminating against persons or communities based on inherent characteristics such as religion and national origin. Of these, 31 (about one in six of the hateful posts) contained the obvious use of AI-generated imagery. 

Chart: Galen Reich

These appear to be part of a larger pattern of politicians and parties globally using generative AI to amplify hateful or divisive content, particularly ahead of major political events such as elections. 

Ahead of the New York City mayoral race last year, Andrew Cuomo’s official X account shared, then deleted, an AI-generated video depicting Mamdani eating rice with his hands and a Black man in a keffiyeh shoplifting. In Italy, several opposition parties complained to a communications watchdog after deputy prime minister Matteo Salvini’s League party published a series of AI-generated images depicting men of colour attacking women or police officers. And in the UK, videos by an AI-generated rapper funded by the far-right Advance UK party, with lyrics targeting Muslims, were viewed millions of times. 

A Campaign of Hate

Both Assam and West Bengal share a border with Bangladesh. BJP, the world’s largest political party, is currently in power in Assam, where legislative elections are scheduled on Apr. 9. West Bengal, which goes to the polls on Apr. 23, is governed by the Trinamool Congress (TMC).

Tensions between India and Bangladesh worsened after former Bangladeshi Prime Minister Sheikh Hasina, who enjoys close ties with Delhi, was ousted in 2024 and fled to India. 

US-based international affairs expert Mohammed Zeeshan told Bellingcat that the “dehumanising and debasing” terminology used in India to refer to alleged illegal Bangladeshi immigrants, including by senior ministers, has caused resentment towards India in Bangladesh. 

“The situation, in fact, was so bad that Hasina herself had subtly warned the Modi government in public statements that Indian domestic rhetoric was endangering Bangladeshi Hindus, who bore the brunt of that resentment,” Zeeshan said. 

Zobaida Nasreen, a professor of anthropology at Dhaka University, said that anti-Muslim rhetoric intensified by BJP leaders reinforces the belief in Bangladesh that Muslims and Bengalis are being collectively targeted in India.

“Viral videos containing this message tend to spread quickly across Bangladeshi media and social platforms especially on Facebook, enhancing perceptions of hostility and triggering anti-India sentiment or nationalist backlash,” she added.

In December, the month our dataset was collected, Dipu Das, a Hindu garment worker, was beaten to death at an anti-India protest in Bangladesh over allegations that he had made derogatory remarks about Islam. 

And while the administration led by Bangladesh’s newly elected leader Tarique Rahman has sought to reset strained ties, most of the hateful social media posts we saw posted by the BJP in December attacked Bangladeshi Muslims and/or Bengali-origin Muslims in India, showing how tensions between the two countries continue to influence political messaging in India’s border states.

Bellingcat’s analysis included a total of 202 posts by BJP Assam and 297 by BJP’s West Bengal branch on their official accounts. We also looked at posts shared by BJP’s main opponent parties – 194 from INC in Assam and 357 from the TMC in West Bengal – during the same time period in December. 

This included all visual social media posts (containing photos or videos) by each party in December, except those that did not appear to contain any overt political messaging, such as those simply commemorating public holidays. We only counted each photo or video once, regardless of how many platforms it was shared across. 

Although all of the major parties contesting in the Assam and West Bengal state elections appeared to use AI-generated imagery in some of their posts, there appeared to be a particularly high concentration of hateful messaging in the ones posted by the BJP’s accounts. 

In Assam, we identified 28 posts by BJP using apparently AI-generated imagery, of which 24 carried hateful messaging. Of the 194 INC posts we looked at from December, 41 appeared to feature AI-generated imagery, but none of these appeared to carry hateful messaging. 

In West Bengal, we found 14 BJP posts that contained clear indicators of AI-generated imagery, seven of which were hateful. We also identified 15 posts by the incumbent TMC that appeared to feature AI imagery, but none of these appeared to meet the definition of hate speech. 

When contacted for comment, BJP Assam spokesperson Rupam Goswami did not directly respond to questions on the party’s general use of AI but said they did not post any AI-generated photos of Gogoi. “BJP does not stoop so low,” he told Bellingcat.

As for the “point blank” shooting video, Goswami initially said the person responsible had been punished and removed from the party. However, when asked about Sarma saying that he would re-post the video with those he was depicted shooting labelled as “Bangladeshis”, Goswami said, “[Bangladeshis] need to be completely suppressed.”

BJP West Bengal did not respond to multiple requests for comment by Bellingcat via phone and email.

It is important to note that as generative AI technology improves, it can be increasingly difficult to detect AI-generated imagery. Our manual count of AI-generated imagery only included posts that had obvious signs of generative AI such as unnaturally smooth textures and multiple people with the same faces. It is therefore possible that there were other images in our dataset where generative AI was used more subtly. 

However, Joyojeet Pal, Professor of Information at the University of Michigan, told Bellingcat that the quality of these visuals, or whether they looked real, was not the priority. 

“What politicians in India have understood is that the sociocultural drivers of misinformation are most important for elections, so they harp on about things to the extent that they have started to not care about form over substance. It looks bad? It doesn’t matter,” he said.

More important to voters, according to Pal, was whether they already believed in the narrative contained in the videos, which generative AI could help create more quickly: “AI is helping cement polarised opinions by giving you the kind of content you have already decided you want to engage with.” 

When asked about INC’s use of AI, party spokesperson Aman Wadud said that it was obvious that some of the videos they posted were made with AI and that there was no intention to mislead. 

“AI can be both destructive and creative. We are using it in a creative manner, we are not using it in a destructive manner. We don’t violate people’s dignity, we don’t falsely accuse people,” he said.

TMC did not respond to Bellingcat’s multiple requests for comment via phone and email by publication time.

Portraying Bengali Muslims as ‘Foreigners’

The largest category of hateful messaging Bellingcat observed in the BJP’s posts targeted Bangladeshi or Bengali-origin Muslims, referring to them as “infiltrators” or “foreigners”. We counted 66 such posts by the BJP’s Assam and West Bengal branches from December, of which eight appeared to contain obvious AI-generated imagery. 

Bengali-origin Muslims are often stereotyped as “illegal immigrants” in the state, although members of the community have lived in India since the late 1800s. 

Last year, the BJP deported thousands of alleged undocumented migrants – reportedly including Indian Muslim citizens – to Bangladesh. Human rights groups have called the deportations unlawful and discriminatory, as well as lacking in due process. 

One video referencing this theme shows AI-generated visuals of protests against “illegal infiltration” in Assam, with the caption urging people to “wake up” or the country would “turn into Bangladesh”. 

A different one uses real footage from past violence in Assam mixed in with images of Muslim men. A song playing in the background accuses them of taking over “Assamese land” and shows AI images of “Assamese” people, i.e. those not in stereotypical Muslim clothing, crying.

Both videos use religious markers to draw a distinction between “infiltrators” – men in skull caps or lungis associated with Bengal-origin Muslims – and “citizens” in non-Muslim attire. 

Clothing is often used by the Hindu far-right as a visual shorthand for identity and a deepening religious divide. In 2019, Prime Minister Narendra Modi said of protests against a controversial citizenship law that those responsible for violence could be “identified by their clothes”. 

In the hateful posts seen by Bellingcat, both real and AI-generated images of opposition figures – particularly Gogoi – were shown alongside messaging that suggested that they supported “foreigners” or “infiltrators”. 

The Center for the Study of Organized Hate (CSOH) also noted, in a 2025 report on AI-generated imagery and Islomophobia in India, that Hindu far-right politicians and media outlets have invoked and reinforced the trope of Muslims as “infiltrators” for years. 

“AI-generated images on these themes reinforce associations between Muslim identity and illegality, reinforcing xenophobic and Islamophobic stereotypes. In doing so, they play a powerful role in justifying exclusionary policies and normalising discrimination against Muslims,” the report said. 

‘Save Hindus’

Zenith Khan, a data analyst who worked on the CSOH report, noted that AI-generated propaganda was often tightly knit with current political moments, and its impact depended on “timing it right” especially when “people are emotionally charged”. 

The violence against the minority Hindu community in Bangladesh has been used by the BJP to raise concerns over the safety of Hindus in India. 

Days after Das’ lynching, the Assam state branch of BJP posted a video with an image of his face – except that it was manipulated with AI to show tears streaming from his eyes. “Save Hindus”, said the text accompanying the video. 

Posts by BJP’s West Bengal unit also seemed to frame Muslims as criminals or threats. A video, styled after the TV show “Stranger Things”, raised alarms over an “upside down” version of the state under the current government. 

A man is depicted being chased by men in skull caps. Arrows label them as “Ralib,” “Galib,” and “Chalib” – a play on Muslim names ending in “-lib” – in case the skull caps left any ambiguity about their Muslim portrayal. 

INC filed a police complaint in September last year against the BJP for sharing AI videos targeting Gogoi and the Muslim community, as well as another complaint in relation to the video of Sarma portrayed as shooting two men “point blank” in February. 

INC Assam spokesperson Wadud said that no action had been taken on the party’s police complaints as far as he knew. 

Disinformation researcher Bharat Nayak told Bellingcat that it has always been tech platforms’ responsibility to control new types of content. 

“The goal post can’t shift. This has always been a tech problem,” he said. 

When this responsibility is shrugged off, Nayak added, the result is a lack of accountability. “If you’re using old videos from other countries as new, you will have people countering you. But AI-generated videos can be shared without context just to spread hate – like showing people in skull caps – and the ‘when, where, how’ questions vanish.”

Both Meta – which owns Facebook and Instagram – and X have policies against hateful conduct. 

Meta also announced in 2024 that it would start adding “AI info” labels to more content detected as AI-generated, while some X users spotted a similar feature introduced on the platform last month. Only five of INC’s AI visuals that we identified – and none of those by TMC or the BJP – had a disclaimer that said “AI-generated”. 

Bellingcat reached out to Meta and X for comment on whether the posts we identified breached their terms of use regarding hateful conduct or labelling AI-generated posts. A Meta spokesperson said they were reviewing the flagged content and “will take appropriate action on any violations of our policies”. As of publication, X had not responded.

---

Kalim Ahmed from Bellingcat’s Discord Community contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post How India’s Ruling Party is Using AI to Boost Hate Speech in States Near Bangladesh appeared first on bellingcat.

A new Android malware campaign targeting Indian users has been reported by the Indian Computer Emergency Response Team, CERT-In. According to the agency, multiple reports indicate a coordinated effort by cybercriminals to steal sensitive financial and personal data through deceptive mobile applications and phishing techniques.  The ongoing Android malware campaign revolves around fraudulent messages posing as official eChallan or RTO Challan alerts. Victims typically receive SMS notifications claiming that a traffic violation has been recorded against their vehicle. These messages often include alarming language such as legal threats or additional penalties, urging immediate action. 

Android Malware Campaign Exploits eChallan and RTO Challan Trust 

A common message reads: “Your vehicle challan has been generated. Download the receipt from the link below.” The link or attachment leads users to download malicious APK files named “RTO Challan.apk,” “RTO E Challan.apk,” or even “MParivahan.apk.”  As highlighted by CERT-In, these files act as entry points for a multi-stage malware infection. Once installed, the application appears in the app drawer, giving the illusion of legitimacy. However, it is only a dropper component. The actual malicious payload is deployed when users tap on prompts like “Install Update.” 

Multi-Stage Malware and Device Compromise 

Once activated, the malware continues the eChallan theme but becomes invisible to the user by not appearing in the app list. At this stage, it aggressively requests sensitive permissions, including access to SMS messages, phone calls, and background activity.  This level of access allows attackers to maintain persistence on the device without detection. In some cases, the malware also requests permission to establish a VPN connection, enabling threat actors to monitor and intercept internet traffic.  The ultimate goal of this Android malware campaign is financial theft. Fake interfaces resembling legitimate RTO Challan or banking pages are displayed to trick users into entering sensitive information such as card details and login credentials. 

Parallel Rise of Browser-Based eChallan Phishing 

Last year, Cyble Research and Intelligence Labs (CRIL) reported a related surge in browser-based phishing attacks leveraging the eChallan ecosystem. Unlike APK-based threats, this variation does not require users to install any application, significantly lowering the barrier for compromise.  These phishing campaigns begin similarly, with SMS messages targeting Indian vehicle owners. The messages contain deceptive URLs that mimic official eChallan portals. Once clicked, users are redirected to cloned websites that closely replicate government platforms, complete with official insignia and branding.  At the time of investigation, many of these phishing domains remained active, indicating an ongoing and well-maintained operation rather than isolated incidents. 

Anatomy of the Phishing Attack 

The browser-based eChallan fraud follows a structured attack chain: 

• Stage 1: SMS Delivery: Victims receive messages claiming overdue fines, often with threatening language about legal action. The sender appears as a regular mobile number, increasing credibility. 
• Stage 2: Fake Portal Redirection: Clicking the link redirects users to phishing domains hosted on IP addresses such as 101[.]33[.]78[.]145. Interestingly, some pages are originally written in Spanish and translated into English, suggesting reuse of global phishing templates. 
• Stage 3: Fabricated Challan Generation: Users are asked to input details like vehicle number, challan number, or driving license number. Regardless of the input, the system generates a realistic-looking challan, often with a fine amount such as INR 590 and a near-term deadline. This psychological tactic reinforces trust. 
• Stage 4: Financial Data Harvesting: When users proceed to payment, they are directed to a fake payment page that only accepts credit or debit cards. No legitimate payment gateway is used. Instead, sensitive details like CVV, expiry date, and cardholder name are captured directly. Testing revealed that even invalid card entries are accepted, confirming that data is harvested regardless of transaction success. 

Shared Infrastructure and Expanding Threat Landscape 

Investigations revealed that this Android malware campaign and related phishing operations are supported by a shared backend infrastructure. Multiple domains impersonating eChallan, logistics services like DTDC and Delhivery, and financial institutions were hosted on the same IP addresses.  Over 36 phishing domains linked to RTO Challan scams were identified on a single server. Another IP, 43[.]130[.]12[.]41, hosted additional domains mimicking Parivahan services using deceptive naming patterns such as “parizvaihen[.]icu.” 

As artificial intelligence (AI) continues to reshape how people interact with technology, the conversation around AI child safety in India is becoming increasingly important. From AI-powered toys to social media algorithms, digital technologies are now deeply embedded in the lives of children. While these tools can support learning and innovation, they also raise serious concerns around privacy, exploitation, and online harm. The Indian government says it is aware of these risks. In a recent statement in Indian Parliament, Union Minister for Electronics and IT Ashwini Vaishnaw listed a series of legal and regulatory safeguards designed to strengthen AI child safety in India and reduce potential risks from emerging technologies. The focus, officials say, is on ensuring that the growth of artificial intelligence does not come at the expense of children's online safety.

AI Child Safety in India Backed by Existing IT Laws

One of the strongest pillars supporting AI child safety in India is the long-standing Information Technology Act, 2000. The law requires online platforms to prevent the hosting or sharing of harmful content involving children, including sexually explicit material or content that promotes violence. Under the law and its associated rules, social media platforms must remove unlawful content quickly after receiving government or court notifications. In some sensitive cases, such as non-consensual intimate content—platforms are required to act within two hours. These provisions are particularly relevant in the AI era, where harmful content can spread rapidly across platforms or be generated using advanced technologies. Authorities say the law also requires platforms to report certain offences to authorities under legislation such as the Protection of Children from Sexual Offences Act, 2012, reinforcing the broader legal framework designed to protect minors online.

Data Protection Rules Strengthen AI Governance in India

Another key element supporting AI child safety in India is the Digital Personal Data Protection Act, 2023. The law introduces strict rules around how children’s personal data can be collected and used, including data gathered through emerging technologies such as AI-powered toys or apps. The law requires companies to obtain verifiable parental consent before processing a child’s personal data. It also places strong limits on practices such as behavioural tracking, targeted advertising, or monitoring directed at children. In practical terms, these rules are meant to ensure that AI systems interacting with children cannot quietly collect or exploit personal data without parental oversight.

Responsible AI Development Remains a Policy Priority

Beyond existing laws, the government has also issued India AI Governance Guidelines to encourage ethical and responsible AI development. These guidelines specifically recognize children as a vulnerable group that could face long-term harm from poorly designed AI systems. They recommend risk assessment frameworks and monitoring mechanisms to help policymakers identify potential AI-related harms early. The emphasis on responsible development reflects India’s broader AI strategy—one that aims to expand innovation while keeping citizens protected. As officials often emphasize, the country’s AI roadmap is closely aligned with Indian Prime Minister Narendra Modi’s vision of democratizing technology and ensuring that digital transformation benefits society as a whole.

Cybercrime Reporting and Enforcement Measures

Protecting children online is not just about policy. Enforcement tools also play a critical role in strengthening AI child safety in India. The government operates the Indian Cyber Crime Coordination Centre and the National Cyber Crime Reporting Portal, allowing citizens to report cybercrimes, including crimes targeting children. Authorities have also worked with internet service providers to block websites hosting child sexual abuse material using global databases maintained by organizations such as the Internet Watch Foundation. In addition, law enforcement agencies receive support through training programs and cyber forensic infrastructure funded under national cybercrime prevention initiatives.

Awareness and Education Remain Essential

Legal frameworks alone cannot guarantee AI child safety in India. Public awareness remains just as important. Government-backed programs such as Information Security Education and Awareness (ISEA) have conducted thousands of workshops across India, reaching students, teachers, police personnel, and members of the public. Research and guidance from bodies like the National Commission for Protection of Child Rights have also helped shape cyber safety guidelines for schools, parents, and educators.

A Strong Framework, but Implementation Matters

India now has a growing set of laws, policies, and awareness programs aimed at strengthening AI child safety in India. Taken together, these measures signal a clear attempt to build guardrails around emerging technologies. But regulations alone cannot solve the problem. As AI systems become more advanced, experts argue that enforcement, platform accountability, and digital literacy will be just as critical as legislation. Without strong implementation, even well-designed safeguards risk falling short. The challenge for India moving forward is to ensure that its ambition to lead in AI innovation does not outpace the protections needed for its youngest digital citizens.

India’s rapidly expanding space sector has received a major policy push with the release of new space cyber security guidelines aimed at strengthening protection across satellite and ground infrastructure. The framework, jointly developed by the Indian Computer Emergency Response Team (CERT-In) and SatCom Industry Association India (SIA-India), signals a growing recognition that cyber resilience is now as critical to space missions as launch capability itself. The guidelines were unveiled during the DefSat Conference & Expo 2026 held in New Delhi, India, at a time when satellite communication systems are increasingly becoming the backbone of connectivity, navigation, defense operations, and disaster management across the country.

Space Cyber Security Moves from Technical Layer to Strategic Priority

India’s space ecosystem is no longer limited to government-led missions. The rapid rise of private satellite operators, ground station providers, and space-tech startups has significantly expanded the attack surface. As satellite communication networks support everything from banking connectivity in remote regions to military operations, the importance of space cyber security has moved beyond technical discussions into national strategic planning. The new framework acknowledges this shift by outlining security controls across the entire satellite lifecycle, from space assets and ground stations to supply chains and user terminals. It also highlights emerging risks such as signal spoofing, unauthorized command uplinks, firmware manipulation, and ground infrastructure compromise. [caption id="attachment_109838" align="aligncenter" width="602"] Image Source: PIB[/caption] These space cyber security guidelines are advisory in nature but provide a structured baseline for organizations to assess and improve their cyber posture. Importantly, the document pushes stakeholders to adopt risk-based governance rather than reactive compliance.

A Collaborative Model for Space Sector Cyber Resilience

According to Sanjay Bahl, Director General of CERT-In, “CERT-In remains steadfast in strengthening the cyber resilience of all sectors across Bharat. Recognizing the strategic importance of space systems, including satellite communication networks, to India’s technological sovereignty and future growth, these comprehensive guidelines establish a unified and forward-looking framework by considering defense in depth, breadth and height to safeguard satellite networks, ground infrastructure, space related supply chains and space assets against the rapidly evolving and increasingly sophisticated cyber threat landscape.” The emphasis on layered defense reflects a broader industry realization—traditional IT security models are insufficient for space systems, where physical assets in orbit cannot be easily patched or replaced. Subba Rao Pavuluri, President of SIA-India, highlighted the importance of public-private collaboration: “Public Private Partnership and the considered views of industry are fundamental to strengthening cyber resilience across any sector. This joint guideline document issued by CERT-In and SIA India reflect a holistic and collaborative approach, integrating industry perspectives with the deep cyber security expertise of CERT-In. Together, they mark a significant step forward in advancing the cyber security posture of India’s space sector and reinforcing its preparedness against emerging digital threats.” The collaborative approach is particularly relevant as private players now design, launch, and operate critical satellite services.

Rising Threat Landscape Forces a Shift in Security Thinking

The urgency behind strengthening space cyber security becomes clearer when viewed against recent threat activity. Anil Prakash, Director General, SIA-India, highlighted the scale of the challenge, emphasizing that India’s expanding space ecosystem can no longer treat cybersecurity as a technical afterthought. “India’s expanding space ecosystem now requires cybersecurity to evolve from a technical afterthought into a core pillar of mission assurance. The joint framework developed with CERT-In institutionalizes resilience across satellites, ground infrastructure, and supply chains—particularly significant at a time when over 1.5 million cyberattack attempts were recorded during Operation Sindoor and attacks on government networks surged nearly sevenfold,” he said. He further explained, “In this evolving threat landscape, critical infrastructure and industry are equally vulnerable. Importantly, these cyber guidelines are based on an adaptive model and will be periodically refined through structured industry consultation to remain responsive to emerging threats and technological advancements.” Concluding with a call to action for the industry, Prakash noted, “For industry, this is a clear call to adopt secure-by-design architectures and align innovation with national security imperatives.”

Why the Space Cyber Security Framework Matters Now

The release of these space cyber security guidelines marks an important shift in how India approaches digital risk in space. Instead of reacting to incidents, the framework promotes proactive controls such as threat intelligence sharing, supply chain security validation, and governance mechanisms including the appointment of CISOs for satellite operations. More importantly, the framework positions space cyber security as a continuous process rather than a one-time compliance exercise. As satellite constellations grow and commercial launches accelerate, cyber resilience will increasingly determine operational reliability. India’s space ambitions are expanding rapidly—but without secure communication layers, innovation alone cannot sustain trust. The CERT-In and SIA-India framework is a timely reminder that the future of space is not just about reaching orbit—it is about securing it.

Cybersecurity budgets are rising across APAC, but CIOs and CISOs still face board scrutiny. Here’s why cybersecurity ROI remains hard to prove.

The post Why Rising Cybersecurity Spend Still Isn’t Convincing Boards on ROI in APAC appeared first on TechRepublic.

Join Bellingcat’s WhatsApp Channel for the latest news and resources from us.

How does one monitor a conflict zone on the brink of civil war, especially in a region which is difficult to access, experiences frequent internet shutdowns and where misinformation is common? In this guide, we outline the open source tools and methods we can use to evidence what is really happening in many such conflict settings.

Our focus for this guide is on India, which recorded 84 internet shutdowns in 2024 – the highest number amongst democratic nations. In early June, authorities imposed a curfew and suspended internet access in parts of Manipur after protests erupted over the arrest of ethnic leaders. The state, in the north-east of the country, has been wracked by violence for years.

The ethnic conflict between the majority, mostly Hindu Meitei population and the indigenous, largely Christian Kuki Zo communities is one of the worst spates of violence Manipur, also known as the “Land of Jewels”, has experienced in decades. 

The Imphal valley in Manipur is surrounded by mountains. It is home to 39 ethnic communities. Just over half of its nearly three million residents belong to the Meitei community, followed by the Naga (20 percent) and the Kuki Zo (16 percent) tribes.

The landscape is complex, with ethnic armed groups divided into multiple factions (this list is not complete):

• The ethno-nationalist militia – yet to be designated as a banned group – Arambai Tenggol (AT), the United National Liberation Front (UNLF) – Meitei
• Kuki National Army, Kuki National Front – Kuki 
• Zomi Revolutionary Army – Zomi
• National Socialist Council of Nagalim (Isak Muivah) – Naga

In May 2023, the Manipur High Court passed an order recommending a Scheduled Tribe status (a category for indigenous communities in India that guarantees affirmative action and constitutional protection over identity and land) for the dominant Meitei community. Tribal communities rallied against the decision while the Meitei community held counter-rallies and counter-blockades. Clashes broke out between the Kuki and Meitei groups. Since then, the conflict has displaced more than 60,000 people and claimed more than 260 lives from both communities.

In this guide, we show you how to use open source methods in any secluded area to:

• Analyse weapon imagery and the groups using them
• Investigate weapons that were looted and where they ended up
• Analyse images of drones potentially used as weapons to deploy munitions

Analysing Weapon Imagery

One effective approach for open source researchers is to trace the digital footprint of  weapons. In the Manipur case, local armed groups, such as the Arambai Tenggol, the UNLF and the Kuki National Front, have been posting weapon imagery mainly in WhatsApp groups and Facebook accounts.

According to media reports, the war has been fueled by weaponry looted from police armouries or procured on the black market either from Myanmar, across the border, or through surrenders in amnesty drives.

The 6,000 firearms looted included pump-action shotguns, grenade launchers, AK-pattern rifles, INSAS rifles and ammunition. The police claimed that in February and March alone, more than 1,000 weapons were surrendered, with more than half from the Meitei-dominated valley districts, where a majority of the weapons were looted.

Bellingcat analysed weapon imagery from 2023 and 2024, accessed from WhatsApp groups and Facebook accounts linked to non-state actors, including the AT, Kuki Zo militant groups, and various volunteer organisations. While these groups have surrendered some weapons in amnesty drives, many sophisticated weapons were not turned in and were only recovered in search operations by security forces.

For verification, we ran screenshots of images of the weapons without visible serial numbers or other markings first through reverse image searches on Google and Yandex. Then, we cross-referenced the images with resources like the Small Arms Survey handbook and Open Source Munitions Portal (OSMP). 

However, these databases are limited in their documentation from India.

We also looked at the public dashboard of Conflict Armament Research (iTrace). This is a far larger data source. However, the full dataset, which contains a huge number of images of weapons from around the world, is not publicly available. Only broad statistics, and no images, are visible via the dashboard.

The Small Arms Survey handbook helped match and identify, to an approximate accuracy, some of the older weapon models published on social media platforms and YouTube. However, the guerrilla modifications or customisation of weapons by the militant and militia groups made it challenging to identify the specific models.

This was the case in a video posted on X, which purported to show militants preparing to fire a mortar projectile.

By breaking down the video into frames using InVID, a platform that contains a number of useful tools for analysing videos, we were able to identify the weapons, providing clearer imagery we could use to go back to reverse image tools on Google and Yandex, as well as the Small Arms Survey handbook.

We identified three weapons from the video:

• A bolt action rifle
• A FAL (Fusil automatique leger)
• A 60mm commando mortar

The shape of the weapon held by the militant wearing the beanie cap and scarf in the same video matches a FAL pattern rifle, such as the Indian 1A1 FAL, which has a distinctive long wooden handguard with multiple elongated ventilation holes. 

“In India, the rifle was produced by the Ordnance Factory, Tiruchirappalli and was in service up to 1998, when it was replaced by the INSAS Rifle. Over a million units of the 7.62 mm SLR rifle have been produced by the OFB,” wrote (Retd) Major General Dhruv C Katoch, who previously served as the Director for Centre for Land Warfare Studies.

Also visible in the video is an unidentified model 60mm commando mortar. Commando mortars are characterised by a more portable design, typically featuring a much smaller baseplate and a sling or carrying handle rather than a bipod, all of which can be seen in the images below.  The reverse image search on Google led us to a file photo on Wikimedia posted by the US Army, besides this assessment by Jesus Roman, Editor of Revista Ejercitos.

Munitions researcher and PhD candidate in War Studies at Kings College London, Andro Mathewson, described it as likely being a 60mm mortar. “It looks like one man is using the mortar tube, which is relatively unusual. Normally, it’s at least a two or three-man team. And the munition looks light green in colour with a sort of light metal-coloured fuse and light silvery tail fins,” he said. “It’s definitely a small calibre mortar, which is a mainstay in military forces. This appears to be military/official manufacture rather than improvised,” Matthewson told Bellingcat.

Which Groups Use the Weapons?

From the data collected from 2023 and 2024, Bellingcat found that many rifles in the images have different furniture and display cloth wraps, improvised slings, aftermarket optics, even taped-on foregrips.

The next step is to identify the various groups in the pictures. Analysing symbols is a good way to do that. For example, we know that the Saipikhup is the traditional weave of the Kukis. It symbolises heritage and identity and is often worn during important occasions. We also found images of Kuki militants wearing this handwoven shawl (saipikhup) belonging to the Thadou indigenous tribe.

Their fatigues bear the insignia of the President faction of the Kuki National Front, which has been accused of attacking paramilitary security forces. Meanwhile, the same group in the image brandishes AR-pattern and INSAS rifles. The INSAS rifle is an Indian police or military issue, matching reported looting from armouries. Several weapons in the image were also heavily customised, consistent with militia or irregular combatant practices.

Other images also offer clues.

The Kangleipak is a seven-colour flag usually brandished by the AT.

Bellingcat also identified the AT’s commander-in-chief, Korounganba Khuman, in the photos and videos. He actively posts on his Facebook profile and has been widely covered by the local and national press.

News outlets are also valuable sources of information. They might contain images of symbols such as flags, which you can then search for on social media. In one of the videos, we identified militants speaking Meitei Lon, a language used by Arambai Tenggol and militant groups like the UNLF, preparing to fire a mortar projectile from a mortar. Their fatigues bore an insignia that we matched to the UNLF armed group using reverse image search, which led us to a news story featuring the group’s flag as the lead image.

Praveen Donthi, a senior analyst with the Crisis Group who visited Manipur last year during elections, told Bellingcat that though he hadn’t seen arms on any of the aforementioned Kuki Zo militant groups, he had seen INSAS rifles, automatics and double-barrel shotguns being wielded by several young men in the Imphal valley.

“I saw these young men who must have been in their early teens to early twenties when I’d gone to meet Meitei Leepun [a Hindu right-wing activist group] first wielding what looked like state-issued weapons,” he said. “Then later, they replaced it with double-barreled guns. But their leader [Pramot Singh] was openly carrying a pistol in his holster when he came to meet me,” Donthi explained.

Donthi, a former journalist who has reported from conflict zones in Kashmir and Chhattisgarh in India, said he was struck by the young men who were heavily armed in a volatile environment without any evident goal or political ideology guiding them.

Weapons Looted: Where Did They End Up?

When investigating conflicts, identifying the origin of weapons is one of the most difficult tasks, particularly in regions plagued by misinformation or a lack of reliable data. This is the case in Manipur.

Of the 6,000 firearms and ammunition looted from state police armouries mentioned earlier, about half of the weapons have been recovered to date. Around 1,200 matched serial numbers from official inventories, according to reports. Of the weapons recovered, approximately 800 sophisticated ones likely originated outside the state, and 600 were crude, locally produced firearms.

The largest surrender of weapons took place in February and March when more than 1,000 weapons were reportedly surrendered, with more than half from the Meitei-dominated valley districts, where a majority of the weapons were looted. The largest cache was surrendered on February 27 by the Arambai Tenggol (AT). However, the state police is yet to complete categorising the details of the weapons and ammunition surrendered between February 20 and March 6 against the inventory of weapons looted from the state armouries.

Bellingcat requested official data from the Manipur police on surrendered weapons matched against serial numbers from official inventories, but had received no response by the time of publication.

Instead, we decided to see what we could find by using open sources. First, we scraped the state police force’s official X profile (@manipur_police) from Sept. 10, 2023, until June 14, 2025. We did it manually and using Meltwater – a social media monitoring tool.

We dug deeper into media reports, experts’ posts and research to understand what was being used locally. In the Manipur case, recovered firearms include locally manufactured bolt-action rifles, improvised mortars and weapons such as the “Pumpi” – a gun made from repurposed metallic electric poles. These are especially common in the hill areas where the Kuki Zo people live.

The heavy reliance on grenades and improvised explosives is consistent with the guerrilla-style, asymmetric engagements – hit-and-fades, booby-traps, and area denial – rather than large-scale firefights. The presence of multiple improvised munitions types reflects local workshops or village-level bomb-making, likely to supplement limited access to military-grade ordnance, consistent with media reporting on the same (see here and here).

Claims Over Weaponised Drones

In September last year, Indian media reported villagers in the valley district witnessing drones allegedly dropping as many as 50 bombs. Kuki Zo village volunteers and insurgent groups were reported to have set up bunkers in the hills, much like their Meitei counterparts in the valley.

These claims were supported by a Manipur Police statement. The central counter terrorism law enforcement authority, the National Investigating Agency, which filed a case alleging weaponised drone attacks, told the Manipur High Court that Kuki militants dropped 40 drone bombs.

A source in the Defence Ministry told Indian news site The Print that the drone videos circulating online were from either Myanmar or Palestine. Many of the videos showed fertiliser drones, but these were deployed by the People’s Defence Forces in Myanmar, they added.

How Do You Investigate Potential Drone Usage With Open Source Tools?

The Manipur Police posted an image of a drone recovered in the Kangpokpi District, a day after the first set of attacks.

The first step is to identify the possible drone type. The easiest way is by using Google’s reverse image search engine. We identified the drone as commercial-grade, weighing approximately 181g. These carbon fibre lightweight drones, built for speed and agility with a payload capacity of up to 1.5kg, are widely available on the internet. Security sources told The Print that the bombs weighed 300-400g and were nine to 10 inches (23 to 25cm) in size.

After establishing the possible drone type, we can also examine the reported impact sites. Since we only have images of the attack sites shown in the media, we asked Andro Mathewson, a reputed munitions researcher and explosives expert completing his doctoral studies on weaponised drones in smaller conflicts at King’s College London, for help. 

He told Bellingcat that in this situation, “the payload is probably quite small. So the damage won’t be extensive”.

“Some of the images that are shared in The Print report,” added Mathewson, “obviously show a lot of destruction, but a lot of it seems to be sort of secondary destruction from fires rather than from explosions itself”.

Nothing was visible that could specifically determine if drones were used to deploy munitions. The damage from a smaller payload like 400-600g of a grenade would not exceed more than 20 to 30m, according to Mathewson, adding that larger or heavier payloads are not typically seen among non-professional militaries.

The next step is to find out if the munitions have been adapted for drone deployment. Mathewson told Bellingcat that photos of drone parts published by the media were not consistent with munitions deployed by drones. Bellingcat was not able to independently confirm the source or authenticity of these photos.

“That shrapnel looks large, very thick, and very heavy, which is more consistent with larger artillery rounds or even small missiles,” he said. He also noted that the printed fin “looks quite small”.

“Fins made out of plastic are not likely to be attached to a much larger munition that’s produced that type of shrapnel,” he told Bellingcat, saying that “from the scale that we can get in those images, those don’t seem to add up to me”.

For future reference, when we asked Mathewson what to look out for to confirm the use of weaponised drones, he suggested two things. One would be to see and verify videos of drone strikes, either shot by other drones or on phones – something that is conspicuously missing from Manipur despite the authorities’ claims that there have been drone strikes, although there is plenty of online footage of other sophisticated weapons used there. Secondly, Mathewson also said it was worth looking out for 3D-printed munition parts, such as 3D-printed fins that are attached to conventional weapons.

“That’s not necessarily a guarantee, but it’s most closely associated with [modified drones] because the only reason you would attach fins to a grenade, for example, is to make them be dropped from drones,” he added.

Correction: This article has been updated after an image previously incorrectly stated members of the Kuki National Front were posing with AK-47s, M4 Carbines and M16 weapons. We also updated it to reflect errors in identifying the bolt action rifle, the FAL and 60mm commando-style mortar grenade. A section on chronolocation of this video was also removed, and a clarification was added that only the public iTrace dashboard was consulted, rather than cross-referenced with OSMP and the Small Arms Survey.

---

Additional reporting by Douminlien Haokip.

Pooja Chaudhuri, Claire Press and Gyula Csák contributed to this report for Bellingcat.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post A Guide To Monitoring Conflict Amidst a Sea of Misinformation appeared first on bellingcat.

This article includes data from Justice Delayed, an ongoing project by the author to create a database of criminal cases from more than 650 district courts in India. 

On the night of Sept. 29, 2008, an explosion ripped through a crowded area in the predominantly Muslim city of Malegaon, Maharashtra in India, killing six people and injuring more than a hundred others. Investigators alleged that the blast was triggered by a bomb planted in a motorcycle registered to Pragya Chandrapalsingh Thakur, then a 38-year-old nun and Hindutva (or Hindu nationalist) activist. 

Thakur was the most high profile of the seven people arrested and charged for their alleged involvement in the blast. Almost 17 years later, all of the accused have been acquitted, with the judge reportedly saying that the prosecution could not prove that the bomb was fitted to the  motorcycle or that it belonged to Thakur.

Appearing in court on Thursday, Thakur reportedly told the judge that the investigation had “ruined [her] life”. She was quoted by several outlets saying that she had been “arrested and tortured” by investigators. She also hailed her acquittal as a “victory of Hindutva”.

Meanwhile, the advocate for the victims’ families has reportedly vowed to challenge the acquittals in India’s High Court.

Thakur’s court appearance on Thursday was a rare one: she has been notably absent for most of the trial, citing medical reasons including brain swelling, impaired sight, and a doctor advising bed rest “due to multiple ailments”.

Although attending hearings related to her case was a key condition of her bail, a Bellingcat analysis of documents from the NIA special court shows she was recorded as present at only three of the 162 court appointments that focused on final arguments of the case, from July 24, 2024 to May 8, 2025.

As of publication, Thakur has not replied to multiple requests for comment over email, text messages, and social media about her absences from court. One of her lawyers, Advocate JP Mishra, told Bellingcat that he only has the contact number of Thakur’s personal assistant, and not of Thakur herself.  

Thakur has been on bail since April 2017, when organised crime charges against her were dropped by the Maharashtra Anti-Terrorism Squad (ATS), a state police body. A year later, the National Investigation Agency (NIA) – the main counter-terrorism investigation agency in India – initiated a new case against Thakur and six others over their alleged involvement in the same incident.

In 2019, Thakur was elected as a Member of Parliament for the central Indian state of Madhya Pradesh under the ruling Hindu nationalist Bharatiya Janata Party (BJP), and served five years in the role before stepping down in 2024 at the end of her term. 

Pragya Thakur: Murder Suspect Turned Politician

This is the second criminal case where Thakur has been charged, and then acquitted due to a lack of evidence.

She was previously accused, then acquitted in 2017, of being one of eight people involved in the December 2007 murder of Sunil Joshi, reportedly a close aide of Thakur before they fell out. 

Joshi was a suspect in the 2007 Samjhauta Express train bombing which killed 68 people, mostly Pakistan citizens. Based on local reports, the court acquitted Thakur and her co-accused after finding the case was not investigated with the “required seriousness” by the NIA and state police, who it said produced “weak and self-contradictory evidences”. Thakur was not present in court when the verdict for this case was delivered.

When the BJP fielded her as a candidate in the 2019 general elections, Thakur had been accused of terrorism, murder and criminal conspiracy over the 2008 Malegaon blast.

Nisar Ahmed Sayyed Bilal, whose son was one of the victims of the Malegaon bombing, filed an application in the trial court to prevent her from running in the election, but this was dismissed.

Thakur won her seat by a wide margin against her opponent – a two-time chief minister of the state – and served as a member of parliament for five years.

While in office, Thakur continued to be a controversial figure. She was often quoted making incendiary comments against the country’s minority Muslim community, including accusing them of “love jihad” and encouraging Hindus to arm themselves against Muslims by sharpening their kitchen knives. This was despite the fact that she was representing a constituency with a significantly Muslim population of more than half a million, as of the latest 2011 census data.

In one of her speeches delivered in parliament in December 2023, Thakur criticised the previous government for allowing Muslims accused of crimes to secure bail “despite being criminals”, even though she was out on bail herself.

She has also been quoted in reports claiming that cow urine can protect against Covid-19 and that the same substance had cured her breast cancer. However, a surgeon who operated on her was quoted in an interview saying that she underwent a mastectomy for the latter condition. One of her lawyers, Advocate JP Mishra, also told Bellingcat that Thakur had two surgeries while in jail, and one after her release, to fight cancer.

The verdict on Thursday marks the end of one of the longest-running terrorism trials in the country.

Procedural delays are not uncommon in India’s justice system – it reportedly has a staggering backlog of 50 million pending cases – but Bellingcat’s analysis found that this case took much longer than other similar ones under India’s anti-terror Unlawful Activities (Prevention) Act (UAPA). Data from the NIA special court, which only deals with charges under the UAPA, shows that five other trials it recorded as completed as of July 25 this year were decided in an average of 19.6 months. The Malegaon case was heard 1,187 times over a period of 84 months before Thursday’s verdict was delivered.

Getting the Data

In India’s justice system, each case before a court is assigned a unique Case Number Record (CNR), which is used for all documents related to that case. 

The CNR may change if the case is transferred between courts. For example, the Malegaon case had a different CNR in the 10 years that it was being investigated by the ATS before it was handed over to the NIA.

Searching the eCourts website for case number MHCC020159052016, the CNR assigned to the proceedings for the NIA special court case, returned 1,187 unique court records from July 5, 2018 to May 8, 2025.

We focused on the hearings that took place after final arguments began on July 24, 2024, up to May 8, 2025, when the verdict was initially scheduled to be delivered. The May 8 hearing was postponed to July 31, and there were no other court appearances recorded between then and Thursday’s verdict. 

Of the 162 court records of the case we extracted for this period, one case from October 17, 2024 had no notes recorded in the documents, making it impossible to determine if Thakur was present or not. 

For the remaining 161 documents, we manually checked the text to determine if Thakur was recorded as present. The full dataset of these documents, as well as the assessment by two independent coders (the author and editor of this story), can be accessed here. 

Our analysis showed that Thakur was recorded as present on only three occasions during this period – first on January 30, 2024, more than six months after the final arguments began, at a hearing the next day, and again on May 8 this year when the verdict was originally scheduled to be delivered.

Medical Reasons Cited for Absences

Court documents and local reports show that Thakur’s absence from proceedings for this case dates back years. While the court has accepted medical certificates produced by her advocates, the judges presiding over the case have also repeatedly noted her absences, with one judge specifically stating in 2019 that she should be in court at least once a week. In December 2020, the prosecution argued that it appeared as if she was deliberately avoiding appearing in court.  

“It seems that they have taken the legal process and court for granted,” Advocate Shahid Nadeem, a representative for the victims, told Bellingcat in an email prior to the verdict. 

A timeline of Thakur’s court attendance during the final arguments:

Thakur has maintained that her absences from court were justified by medical reasons, including conditions she claims were caused by “torture” while in custody of the ATS. During her term as an MP, the court also granted exemptions to her court appearance based on her lawyers’ arguments that she needed to attend parliamentary sessions.

On Sept. 3, 2024, Thakur’s lawyers filed for an exemption for her appearance in court, saying she was “suffering from neurological problem with swelling in brain and is unable to see properly”. The court approved the application on the condition that exemptions were filed for each day the case was heard until Thakur appeared, stating that she should appear at the latest by Sept. 18. 

A week after this application, on Sept. 10, a local BJP leader from Bhopal posted a video on Instagram showing Thakur attending a groundbreaking ceremony for a temple in the Madhya Pradesh city. Bellingcat was unable to independently verify when this groundbreaking ceremony took place, and whether it was during the period that Thakur’s lawyers said she was seriously ill. Bellingcat emailed Kishan Suryavanshi, the local leader who posted the video, to ask when it was recorded, but did not receive a reply as of publication. 

On Sept. 18, Thakur’s lawyers filed another application saying that she had been moved from a hospital in Bhopal to one in Meerut, in the neighbouring Uttar Pradesh state. The application said her medical condition had deteriorated, that she was “unable to see properly” and that it would take a “long time” for her recovery. The court approved this application, with the same condition that her lawyers must file exemptions for each hearing that she was absent from court, until a latest date of Sept. 30. 

When yet another application was filed for similar reasons on Sept. 30, Special Judge AK Lahoti warned that Thakur should appear by Oct. 3, or a court order would be issued. One of Thakur’s lawyers began making final arguments for her case that day. 

Despite this warning, the judge continued to grant exemption applications made for Thakur throughout October, as final arguments specific to the charges against her continued in court. Finally, on Nov. 5, 2024, Lahoti rejected an application by Thakur’s lawyers to exempt her from court yet again. 

This application, according to the court documents, was filed with a photocopy of a medical certificate showing that Thakur was undergoing “panchkarm treatment”. This may refer to Panchakarma, a type of Ayurvedic or alternative medical treatment. Mishra, Thakur’s lawyer, told Bellingcat that Thakur was in an Ayurvedic hospital in Meerut at the time.

In response, Lahoti issued a bailable warrant of 10,000 Indian Rupees (US$114) for Thakur, stating that the final hearing would proceed and that Thakur’s presence “is necessary”. A bailable warrant is a warrant for arrest that allows the accused to be released if bail is paid to guarantee their appearance in court. 

The next day, a photo of Thakur was posted to her X profile, with her face looking slightly swollen. In the caption, she seemed to blame the Indian National Congress for “torture” and “suffering”, including brain swelling as well as hearing and visual impairment. The last line of her post, in Hindi, translates to, “If I live through this, I will definitely go to court.” 

‘No Special Treatment’

Thakur’s trial has been a controversial one. In 2015, the former special public prosecutor (SPP) assigned to the case, Rohini Salian, said the NIA had asked her to “go soft” on the case, an allegation the agency denied. 

Nadeem, the advocate for the victims, told Bellingcat: “As far as the appearance of the accused during the trial, NIA’s prosecutor has not taken objection to the exemption application of the accused on most of the occasions.” 

“Victims have limited rights in criminal trials,” he said. 

Bellingcat contacted three senior officials in the NIA vertical of the Counter Terrorism and Counter Radicalization Division, which is part of the Ministry of Home Affairs of India, asking to discuss how the agency viewed Thakur’s absence from court. As of publication, the officials had not replied to multiple emails. 

The current SPP Avinash Rasal told Bellingcat that Thakur had provided medical reasons for her absences during the final arguments and that her reasons were considered by the court. “At no time the case was stalled due to non-appearance of the accused. Their advocates always remained present,” he added. 

Bellingcat’s analysis shows that Thakur’s advocates were recorded as present at all 161 hearings after final arguments began.

On at least two occasions in October 2024, the judge accepted the exemptions filed for her absence while noting that her advocates were present and her absence was “not causing any hurdle in the smooth trial”. The same judge, however, also said the next month that her presence was necessary for the final arguments.

Rasal said there was “no pressure” on the prosecution due to Thakur’s position as a member of parliament. 

“No special treatment was given to anyone.”

---

Galen Reich designed the scrolling timeline for this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Former Indian MP’s Terror Trial Was Largely Conducted in Her Absence appeared first on bellingcat.

This article is a collaboration with Alt News, a non-profit fact-checking website in India. Read the article on Alt News’ website here.

They describe themselves as “cow protectors” or “gau rakshaks” in Hindi. On social media, they often post about carrying out charitable work such as operating ambulances for sick or injured cows, feeding stray animals and distributing food to people.

But in the dark of the night, their work takes on a more violent edge. Multiple photos and videos show members of “cow protection” groups chasing, shooting at and beating up truck drivers they claim are “smuggling” cows for slaughter. 

Cows are considered sacred in Hinduism, the dominant religion in India. Many states in the country prohibit the slaughter of cows and have strict laws on the transportation, sale and purchase of cattle. These laws have become more stringent since the Hindu nationalist Bharatiya Janata Party (BJP) came into power in 2014.

The vigilantes attacking truck drivers tend to be closely aligned with hardline Hindu nationalist organisations, and a majority of their victims are Muslims. And while they claim to be doing this for the sake of the cows, in some of the videos the animals can also be seen injured from vehicles overturning during aggressive chases. 

Elaine Pearson, Asia Director at Human Rights Watch, told Bellingcat that cow protection has become part of the political agenda of leaders of the BJP and in some cases they have backed the alleged actions of the suspects “while the police have failed to take action against them”.

Bellingcat and our partners at the Indian outlet Alt News found videos on social media showing violent assaults by members of five self-described animal welfare groups, mainly operating in the states of Uttar Pradesh and Haryana where incidents involving cow-related violence have frequently been reported. 

(Editor’s note: We are not sharing links to these videos to avoid amplifying content depicting violent attacks seemingly targeting minority groups. However, if you are a journalist or researcher interested in obtaining this dataset, please email inquiries@bellingcat.com.)

Some of the leaders of these vigilante groups, when we reached out to them, claimed that they were working closely with the local police. One even received an award for “cow and social service” from a cabinet minister, alongside police officers. Senior police officers from the districts that these groups operate in did not answer questions about alleged police support for the cow vigilantes when we could reach them. 

While these groups most likely only represent a small fraction of the “cow vigilantes” in India, who have been reported on by the media and human rights groups in the country for years, our investigation sheds more light on how they informally work together to carry out mob violence against truck drivers.

Akhil Bharatiya Gau Seva Samiti (ABGS)

In a video uploaded in February this year, several men in cars are seen chasing a truck down a highway at night. A man from one of the cars pulls out a shotgun and fires at the truck. Police sirens can be heard in the background but law enforcement does not appear to interfere. 

Akhil Bharatiya Gau Seva Samiti (ABGS), which uploaded the car chase video, is a trust – a non-profit organisation (NPO) formed to promote charitable activities. It was established in 2022, according to the Indian government’s non-profit database. ABGS is based in Vrindavan, Mathura district in the state of Uttar Pradesh. 

While its day job may seem to be “animal welfare”, videos of its members terrorising truck drivers at night are routine and oftentimes, promoted by the trust itself. 

ABGS president Bharat Gautam shared a post in November 2024 that shows a smashed-up car, with a sign for “Akhil Bhrataiya Gau Seva Samiti” on top of it, after what he described in Hindi as a “heavy encounter with cow smugglers”. 

Alt News spoke to Gautam, who said that cows are “not an animal”, but a mother figure in Hinduism.

Gautam claimed that his team works closely with Vrindavan police to save cows from being slaughtered for meat. “We either pass on the information we receive [about trucks transporting cattle] to the police and they accompany us in our pursuit or we patrol areas we know are frequented by cow smugglers,” he said, adding that the police register cases against the drivers based on complaints filed by his team once the vehicle is caught. Multiple calls by Alt News to the Vrindavan police station’s general line, as well as to the direct lines of senior police officials from the district, to request for comment on ABGS’ claims went unanswered. 

“We help the administration but they can’t do everything so it’s also our duty to protect our religion, our mother,” said Gautam.

However, videos shared by his team reveal that the cows they claim to rescue are also frequently injured during their car chases. For example, a video from February last year shows a pick-up truck that had overturned apparently as a result of being pursued, causing the cattle inside to fall onto the road. The video shows three men sitting on the ground, looking gravely injured, and several people hitting them while posing for photos. Meanwhile, the cows can be seen sprawled on the side of the road, also apparently injured.

Gautam’s team operates in Uttar Pradesh, which is one of at least 20 out of 28 states in India that either partially or completely bans the slaughter of cows and the sale of beef. When Alt News asked Gautam about his team’s use of violence, he shifted the blame onto the truck drivers. “Cow smugglers collide with our cars … shoot at us,” he said.

ABGS’ headquarters are located in Vrindavan city’s Venkatesh Temple. When Alt News contacted the temple, they claimed to have no connection with the group. “We only rent out a space,” a temple staff member said. 

Gautam told Alt News that the temple does offer some support to his team, including manpower and financial assistance. But he maintained that most of their work was self-funded and denied receiving any government aid or donations, despite the trust having appealed for donations on social media.

His “cow protection” activities have also won him recognition from the Uttar Pradesh government. In January last year, he received an award for “cow and social service” from a cabinet minister in the state. For this, he was congratulated in the presence of the district magistrate of Mathura city, who is responsible for maintaining law and order in the district, and Mathura police. 

Multiple calls made to senior police officers in Mathura district went either unanswered or the officers did not comment when asked about the Mathura police’s relationship with Gautam and whether they supported cow vigilantism.

Team Sonu Hindu Palwal

While ABGS’ vigilante activities have been particularly visible on social media, our investigations found it is part of a network of local groups based in Uttar Pradesh and Haryana. In a video uploaded on June 27, Gautam says that cow vigilantes have been working under the guidance of one “Sonu Hindu Palwal” the past five years. 

In March, videos shared by ABGS and several related cow vigilante groups show cars chasing a truck, and two men being brutally beaten and kicked.

Bellingcat geolocated the incident to a location outside a police station in Beri in the state of Haryana based on the trees, lamp posts and a temple seen in one of these videos, posted by a member of “Team Sonu Hindu Palwal”.

This location matches reports of an attack that took place in Beri on March 9, where eight men  were arrested after a police officer on the scene filed a complaint. The officer’s complaint stated that the mob shouted “we will not leave you Muslims alive today” while beating up the two men from the truck. 

A man who goes only by one name, Sonu – his official name listed on court documents – was among the eight arrested. He operates a team named after himself called “Team Sonu Hindu Palwal”. Palwal is the district in Haryana state where his team primarily operates.

Sonu told Bellingcat that he is the Palwal district president of Gau Raksha Dal (GRD) – literally “cow protection” unit – an NPO established in 2012. The GRD is one of the largest cow protection networks in India, and its leader told Human Rights Watch in 2017 that the network’s volunteers have a presence in nearly every state.

When asked about the incident in Beri, Sonu said that while they were chasing the truck drivers, the truck collided with another car, and the passengers of that car beat up the truck drivers. “We were blamed”, he said – even though videos of the assault were shared by members of his own team.  

Bellingcat also showed Sonu several videos posted by cow vigilante groups including Team Bharat Gautam that either tagged Team Sonu Hindu or mentioned them in their captions. These videos showed men surrounded by members of the cow vigilante groups, who were hitting them or otherwise treating them roughly. Sonu was personally seen posing for a group photo in one of these videos, even though he wasn’t shown assaulting anyone. When shown these videos, Sonu denied that his team beat people up.

The cow vigilante leader did not directly respond to our questions about what he thought about violence committed by members of his team, but said: “Do whatever you want. Our job is to save cows and we will continue to do so.”

The day after his arrest in Beri, videos of Sonu’s supporters celebrating his release began circulating on Instagram. He and others from his team were paraded in a car with garlands around their necks and a procession followed them while dancing to “Hindutva pop”, a genre of music associated with the Hindu far-right which carries lyrics with anti-Muslim rhetoric.

The men beaten up by Sonu and his team in March were arrested after a counter-complaint under animal cruelty and cow protection laws was filed against them.

When Alt News called the police station’s number, the police personnel who answered did not seem to know whether the two men seen being attacked in the video were still in jail. One of them said that the case has been transferred to the crime unit but was unable to provide any details of the investigating officers. 

However, bail orders for the two men who were beaten up, which Bellingcat found on the district court website of Palwal, indicated that they each spent at least two months in custody before being released on bail.

Alt News spoke to Sonu who said that his team is tipped off by “informants” whenever cows are being transported, receiving details such as the vehicle’s route and licence plate number. 

According to Sonu, the rescued cows are taken to shelters, while the people transporting them are handed over to the police. He said that the police sometimes show up after a vehicle is intercepted, but at other times the police are with the gau rakshaks during these incidents. 

Alt News’ questions to the Additional Superintendent of Police, Palwal about Sonu’s claim that the police accompanies his team in their pursuits of truck drivers went unanswered.

Bellingcat also found links between Team Sonu and a Mumbai-registered charitable trust, through a photo Sonu posted showing a large truck which he described as an “ambulance for sick or injured cows in Palwal”. There is a Google Pay number shown on the vehicle for receiving donations.

The signage on the ambulance says the service is “courtesy of” an organisation called “Shri Mahesh Chand Dalmia Charitable Trust”, which appears to be a misspelling of “Shri Mahesh Chandra Dalmia Charitable Trust”, a registered trust based in Mumbai. 

Sonu told Alt News that Shri Mahesh Chandra Dalmia Charitable Trust supported his team’s ambulance after local priests in Vrindavan introduced the organisation to his work. 

According to the government’s NPO database, the trust works in the sectors of “Education & Literacy, Any Other, Health & Family Welfare”. The trustee, or person who manages the trust, is listed as Satyadeo Banka. 

Banka is regularly tagged on Facebook in videos of Team Sonu’s attacks on truck drivers. His posts on the platform also frequently promote ideas in line with Hindutva, a nationalist ideology that advocates for establishing India as a Hindu nation-state. 

We attempted to contact Banka on social media but did not receive any response. Alt News contacted the trust’s president, Rahul Dalmia, on the phone and emailed him about his organisation’s relationship with Team Sonu Hindu Palwal, asking whether he was aware of the group’s violent activities and Banka being tagged in their “cow protection” videos. Dalmia declined to be quoted when asked about the trust’s work over the phone, and did not respond, as of the time of publication, to further questions over email about whether the trust supported cow vigilantes in any way.

Live For Nation 

In 2021, Sonu congratulated someone he referred to as “LFN’s Parveen” for joining the Haryana government’s cow protection force, in a post on Facebook. LFN is the abbreviation of “Live For Nation”, a registered NPO in Haryana’s Faridabad which aims to “save cows”. This group was also involved in a car chase last year that resulted in the death of a 20-year-old man.

On Aug. 23, 2024, Aryan Mishra, 20, was out with his friends on a drive when five cow vigilantes – all LFN members – allegedly “mistook” them to be cattle smugglers and began chasing their car before firing at them. Mishra was killed in the incident. 

One of the accused who was arrested, Anil Kaushik, reportedly told Mishra’s father that he thought the boy was Muslim and regretted killing a Brahmin, the highest ranking caste in the Hindu caste system. Kaushik identified himself as a member of Haryana government’s special cow protection task force, which Parveen is also a part of. 

His full name is Parveen Vashisth and his Facebook bio says that he is a member of the Haryana government’s “special cow protection task force”. Vashisth also names the task force while sharing videos on Instagram of cow vigilantes from Team Sonu Hindu chasing trucks. 

Alt News reached out to the “Haryana Gau Seva Aayog”, the government body responsible for overseeing the task force. Its chairman, Sharwan Garg, said that anyone can engage in cow protection work independently, provided they stay “within the limits of the law and coordinate with the authorities”.

However, Vashisth’s videos on Instagram showing Team Sonu Hindu chasing after trucks, shooting at them and assaulting drivers appear to show that these “limits” are often breached.

Gau Seva Mission

Another organisation that claims to work for cow welfare and operates in the same network uploaded a video on Jan. 9, 2025, showing vigilantes capturing a man they claimed was a “cow smuggler”. In multiple videos, the man looks gravely injured and bloody. His vehicle is also badly damaged. 

The organisation, “Gau Seva Mission”, is based in Vrindavan, like ABGS. Its leader, Govind Singh, is frequently tagged in videos of attacks on alleged “cow smugglers” along with Bharat Gautam, Sonu and Parveen Vashisth. 

Singh told Alt News that he is a veterinary doctor by profession and bears most of Gau Seva Mission’s expenses through his private work. 

Gau Seva Mission appears to be known to the Uttar Pradesh government. In November last year, Singh uploaded photos and videos of the chairperson of the Uttar Pradesh government’s cow service commission visiting his office. 

Singh told Alt News he used to be a member of the GRD – the NPO that Sonu is a member of – but left the organisation to start his own group, although he did not say when this was. One of Singh’s Facebook posts from three years ago gives the helpline number of GRD’s Vrindavan branch – the same number is now the helpline number of Gau Seva Mission. Its office also used to be at the same address as the office of the Vrindavan branch of GRD at least until March 2022, according to older images of the location on Singh’s Facebook account. 

Gau Vansh Sewa Dham

Another organisation that claims to be involved in animal welfare but whose leader has been involved in cow-related violence is “Gau Vansh Sewa Dham”, in Haryana’s Faridabad. It is run by Shiva Dahiya, who told Alt News that the group runs a hospital for cows.

Videos of injured cows being treated are all over the Facebook page of the organisation, and Gau Vansh Sewa Dham makes regular appeals for donations to support their rescue and relief efforts. Dahiya said that the money for his organisation’s work is raised from the community. 

Posts on Instagram that tag Dahiya show him seemingly participating in or being present at the scene of vigilante attacks targeting those transporting cattle. For example, one post from February shows him holding tire puncture spikes to stop a truck. In another, he is seen pulling an injured man, who was slumped over, up by his hair so his face was visible as a group of vigilantes – also including Sonu – posed for a picture with several captured men. 

However, when Alt News asked if the car chases ever got violent, Dahiya said, “We don’t want to do any wrong by our hands”. And when asked if he had ever done anything wrong, he replied, “By the grace of God, never.”

Dahiya denied there was any violence committed by “cow protectors”.

“We never beat anyone,” he told Alt News.

---

Shalaka Shinde contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Violence in the Name of Cows: The ‘Animal Welfare’ Groups That Beat Up Truck Drivers in India appeared first on bellingcat.

India and Pakistan have been trading blows in the wake of a militant attack on tourists in Indian-administered Kashmir last month. 

On May 7, India said it had launched missile strikes in Pakistan and Pakistan-administered Kashmir. Pakistan – which denies any involvement in the April attack on the tourists, most of whom were Indian – then claimed to have shot down Indian drones and jets.

Claims and counterclaims of ongoing strikes and attacks have been forthcoming from both sides. Some have been difficult to immediately and independently verify, creating a vacuum that has enabled the spread of disinformation.

For example, on May 8, a deepfake video of US President Donald Trump appearing to state that he would “destroy Pakistan” was quickly debunked by Indian fact-checkers. Its impact was therefore minimal.

However, the same cannot be said of another deepfake video spotted by Bellingcat and, by the time of publication, at least one Pakistani outlet.

The altered video had been shared on X (formerly Twitter) nearly 700,000 times at the time of publication and purports to show a General in the Pakistani army, Ahmed Sharif Chaudhry, saying that Pakistan had lost two of its aircraft. 

A Community Note was later added to the video on X detailing it as an “AI generated deepfake”.

However, several Indian media companies had already picked up and ran with the story, including large outlets like NDTV. Other established news media that featured quotes from the altered footage in their coverage include The Free Press Journal, The Statesman and Firstpost. 

Bellingcat was able to debunk the video by finding another clip of the same press conference from last year. The video confirms that a different audio was added over the original footage, with Chaudhry’s lips appearing to sync with the altered audio.

The position of the microphones, Chaudhry’s position in relation to the flags, and his movements are identical. Both videos cut to the audience which is also the same.

You can see the video published on Facebook in 2024 here and the manipulated video published on X here.

Mohammed Zubair, co-founder of Indian fact-checking organisation Alt News, told Bellingcat that mis-and-disinformation are commonly found on Indian social media. But while it may be easy enough for trained fact-checkers to debunk a deepfake where an old video is recycled and the audio manipulated, Zubair was concerned that the common public may just hit the share button because of its emotional appeal. “It is actually very worrisome because it looks very convincing,” he said.

Bellingcat contacted NDTV, The Free Press Journal, The Statesman and Firstpost about the details of this story but did not receive a response before publication.

NDTV and The Statesman later deleted their reports without clarification. Yet experts warn videos like these act as a warning to the continued and evolving dangers of disinformation. 

Rachel Moran, a senior research scientist at the University of Washington’s Center for an Informed Public, told Bellingcat that the speed with which such videos can be created and posted brings a new challenge.

“In crisis periods, the information environment is already muddied as we try to distinguish rumours from facts at speed,” Moran said. “The fact that we now have high-quality fake videos in the mix only makes this process more taxing, less certain and can distract us from important true information.”

---

Correction: This article was amended on May 9 to clarify that the Facebook video of Chaudhry was published in 2024 and not 2025.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post India-Pakistan Conflict: How a Deepfake Video Made it Mainstream appeared first on bellingcat.