34. Indian Cyber Law and Cyber Crime Awareness
34.7 Red vs Blue, Project and Real Incidents
Chala mitrano, IT Act sections, CERT-In 6-hour clock, DPDP, 1930, cybercrime.gov.in, Sanchar Saathi – aata Purple Team loop. Red side madhe fraudster / insider misuse / slow reporting (UPI-KYC call, delayed bank freeze, evidence wipe) dakhavto; Blue citizen + organisation response – 1930 + bank freeze, cybercrime.gov.in complaint, CERT-In report, evidence pack, DPDP note, Sanchar Saathi. Tumhi Sahyadri Traders style OWN tabletop drill madhe build → hack → fix karun Purple report liha. Ha hacking lab nahi – kayda ani response drill aahe. Samjla ka? Real fraud, real victims, real banks – kadhi nahi.
Red Team vs Blue Team – Indian cyber law and fraud response
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Fake UPI / KYC / "digital arrest" call to create urgency | Teach never share OTP/UPI PIN; call bank on official number; 1930 first |
| Push victim to delete chats / screenshots ("we will reverse") | Evidence pack: UTR, screenshots, numbers, URLs, email headers – do not delete |
| Insider misuse of shop systems / customer data | Access control, logging, DPDP-minded handling; least privilege for staff |
| Delay bank freeze so money moves further | Call bank + 1930 immediately; file on cybercrime.gov.in |
| Organisation hides or slow-walks a reportable incident | CERT-In 6-hour clock for specified incidents; IR playbook ready (Ch.31) |
| Vendor / partner leaves passenger or customer PII exposed | Vendor risk + DPDP duties; know who holds your customers' personal data |
Defender chi simple checklist: 1930 + bank freeze → cybercrime.gov.in → evidence pack → account harden (password/2FA) → CERT-In if org incident → DPDP assess → Sanchar Saathi/Chakshu for fraud SIMs → prove drill with tabletop. Red = fraud urgency / delay / wipe; Blue = speed + law + evidence. Interview madhe "I know section numbers" peksha "I built a 1-page IR and fraud response playbook for an OWN shop drill, ran a fake UPI/KYC tabletop, and showed the evidence pack and CERT-In clock" jast strong.
# OWN tabletop only – Sahyadri Traders (Pune) – NO real fraud, NO real banks
mkdir -p ~/labs/sahyadri-cyberlaw
# 1) BUILD – 1-page IR + fraud response playbook (fill YOUR names/phones):
cat > ~/labs/sahyadri-cyberlaw/playbook.md << 'EOF'
# Sahyadri Traders – fraud / cyber IR one-pager (OWN drill)
1. Financial fraud: call 1930 + bank freeze (official number from card/app)
2. File complaint: cybercrime.gov.in – keep acknowledgement number
3. Evidence list: UTR, screenshots, phone numbers, URLs, chat export, email headers
4. Org clock: CERT-In within 6 hours for specified incidents (cert-in.org.in)
5. DPDP note: what personal data was involved; who to tell (check current rules on meity.gov.in)
6. Sanchar Saathi / Chakshu: report fraud call/SMS; check SIMs in your name
7. Do NOT pay "recovery agents" or blackmailers
EOF
# 2) TABLETOP "hack" – role-play only (classmates / Raja-Rani staff fiction):
# Fake UPI/KYC call script – actor never contacts real banks or strangers
echo 'Tabletop: fake KYC caller asks for UPI PIN – victim must refuse + start playbook' \
> ~/labs/sahyadri-cyberlaw/tabletop-script.txt
# 3) FIX / RE-VERIFY:
# Complete drill once; fill evidence pack checklist; Purple 1-pager for Raja/Rani
echo 'Ethics: IT Act – drill only; no real fraud; no third-party accounts' \
>> ~/labs/sahyadri-cyberlaw/playbook.md
Ravindra Bagale's Tip
Students memorise section numbers – but leave the 1930 call order and the evidence list blank. The second mistake: phoning a real bank or strangers during a tabletop exercise. Rule: OWN/class role-play only → playbook 1-page → fake UPI/KYC drill → evidence pack + CERT-In clock → Purple report. The law chapter is really a response-speed chapter. Don't worry, the checklist gets you there.
Ravindra Bagale's Tip – मराठी
Students section numbers पाठ करतात – पण 1930 call order आणि evidence list रिकामी ठेवतात. दुसरी चूक: tabletop मध्ये खऱ्या bank / अनोळखी लोकांना phone. Rule: OWN/class role-play only → playbook 1-page → fake UPI/KYC drill → evidence pack + CERT-In clock → Purple report. कायदा chapter = response speed chapter. घाबरू नका, checklist ने जमते.
Ravindra Bagale's Tip – हिंदी
Students section numbers रट लेते हैं – पर 1930 call order और evidence list खाली छोड़ देते हैं. दूसरी गलती: tabletop में असली bank / अनजान लोगों को phone. Rule: OWN/class role-play only → playbook 1-page → fake UPI/KYC drill → evidence pack + CERT-In clock → Purple report. कानून chapter = response speed chapter. घबराओ मत, checklist से आ जाता है.
Lab
Sahyadri Traders sathi ~/labs/sahyadri-cyberlaw/playbook.md liha (1930, bank freeze, cybercrime.gov.in, CERT-In 6 hours, evidence list, DPDP note, Sanchar Saathi). Classmate barobar fake KYC/UPI call role-play – OTP/PIN share nahi; real bank nahi. Mag evidence checklist tick kara ani 1-page Purple note Raja/Rani sathi. Real fraudster / random numbers var call nahi.
Project: Build it, hack it, fix it
Build: For fictional Sahyadri Traders (Pune wholesale shop):
- Write a 1-page IR + fraud response playbook: 1930, bank freeze, cybercrime.gov.in, CERT-In 6-hour clock, evidence list, DPDP note, Sanchar Saathi/Chakshu
- Scope file: this is a classroom / OWN shop tabletop – no production bank APIs, no third-party customer data
- Ethics card: IT Act – no real fraud, no contacting strangers as "test callers", no paying recovery-scam scripts
Hack (tabletop awareness only – NOT a hacking lab):
- Role-play a fake UPI / KYC / "account freeze" call (classmate as caller; you as shop staff)
- Show how urgency pushes people to share OTP or delete evidence
- Stop the drill when the victim should start the playbook – do not improvise real money movement
Do not call real banks as a prank, do not use real customer phone numbers, do not file false complaints on cybercrime.gov.in, do not run malware against any bank.
Fix:
- Complete the drill once with the playbook open; fill every checkbox
- Build an evidence pack folder (sample UTR/screenshot placeholders labelled FICTIONAL)
- Note CERT-In contact path and who in Sahyadri owns the 6-hour clock
- Add a one-line DPDP reminder: personal data of customers is not "just Excel"
Re-verify: Second short tabletop – staff hits 1930/bank order without prompting; evidence pack complete; Purple 1-page report for owners Raja and Rani. Peer-review with Zoya / Salman. IT Act: legal/response drill only; authorised classroom scope.
Real incident: Cosmos Bank cyber heist (Pune, 2018)
In August 2018, Cosmos Cooperative Bank (Pune) disclosed a major cyber attack. Public reporting described malware on bank systems and a wave of fraudulent ATM withdrawals in multiple countries, along with SWIFT-related fraudulent transfer activity. Indian media and later case coverage treated it as a landmark Indian bank cyber heist; amounts were reported at large scale (treat published crore figures as reported, not as your invention). Weakness: malware persistence on banking infrastructure + insufficient detection/response before card and payment rails were abused across geographies. What would have reduced it: stronger endpoint/malware monitoring on critical bank systems, faster card controls and international withdrawal limits when anomalies appear, network segmentation around payment messaging, and practiced incident response with regulators (CERT-In class reporting for organisations). Lab lesson: your Sahyadri playbook's speed + evidence + CERT-In clock is the small-business cousin of the same Blue habit. Source: Cosmos Bank public statements and major Indian / international news coverage of the August 2018 heist; verify current summaries.
Real incident: Air India / SITA passenger data breach (2021)
In 2021, Air India publicly described a data incident affecting passenger information processed through SITA, a major aviation IT provider whose passenger service systems had been breached in a wider industry event. Reporting described exposure of personal data such as contact and passport-related details for a very large number of passengers (treat published headcounts as reported). Weakness: rich passenger PII held by a vendor – when the vendor is hit, every airline customer on that platform can be affected. What would have reduced harm: tighter vendor risk reviews, least data retained, encryption and access logging at the processor, and clear breach-notification playbooks. DPDP-era lesson for Indian organisations: if you handle personal data for customers, "the vendor was breached" does not erase your duty to know what data you hold and how you respond. Lab lesson: Sahyadri's DPDP note in the playbook is not theory – vendor + PII is the Air India/SITA shape. Source: Air India customer notifications and major coverage of the 2021 SITA / Air India passenger data incident; verify current summaries.
Real incident: TA4922 – Hindi Income-Tax phishing in India (July–Aug 2026)
1. What happened In July 2026, Proofpoint tracked Chinese-speaking actor TA4922 in at least two campaigns against Indian organisations. Emails were written in Hindi, impersonating the Income Tax Department (underreported income, foreign assets, fines, legal threats). Attachments were ZIP files posing as tax documents; opening them led to the PackClient malware framework (surveillance / theft capabilities per Proofpoint). CIOL summarised the research on 28 August 2026. A later campaign allegedly used legitimate remote-management software after initial compromise.
2. How the hack happened (public reporting only – high-level) 1. Attackers crafted local-language phishing that copies real tax-fear themes (urgency + authority). 2. Emails reached staff inboxes with a malicious ZIP "tax notice" attachment. 3. Victim opens the attachment → malware install chain → PackClient on the workstation. 4. Malware enables monitoring and data theft (keylogging, screenshots, files – per researcher descriptions). 5. In a follow-on pattern, attackers may install legitimate remote-admin tools to keep access looking "normal."
3. How to stop it / defend (this chapter: Indian cyber fraud awareness) - Never open tax ZIPs from email; verify only via official Income Tax portals/apps you already use – not links or files in the message. - Hover sender; government mail rarely arrives as random ZIP urgency threats. - Mail gateway: block uncommon attachment types to general users; sandbox / detonate suspicious ZIPs. - Endpoint: EDR, restrict local admin, alert on new remote-management tools. - Report: 1930, cybercrime.gov.in; keep email headers and the file hash as evidence (IT Act / CERT-In awareness).
4. How to take care so it won't happen again (checklist) - [ ] Staff drill: Hindi/English tax and KYC phishing examples (classroom or consented OWN org only). - [ ] Written rule: no government attachment from email – always use the bookmarked official site. - [ ] Attachment policy + EDR; remove local admin from day-to-day users. - [ ] If opened: disconnect network, preserve the PC for forensics, reset passwords from a clean device, report 1930. - [ ] Org CERT-In / DPDP contact list ready if malware spreads beyond one laptop.
Source: CIOL Bureau, 28 Aug 2026, citing Proofpoint research on TA4922 / PackClient (July 2026).
Interview model (clean English): "I wrote a one-page fraud and CERT-In response playbook for an OWN shop drill, ran a fake UPI/KYC tabletop with classmates only, preserved a fictional evidence pack, and explained DPDP and Sanchar Saathi as Blue habits – I do not run real fraud tests."
Thodkyaat: fraud urgency olakha, pan 1930 + evidence + CERT-In + DPDP playbook shika. Aata pudhe careers, certifications ani bug bounty – legally kasa vadhaycha. Chala pudhe, mitrano!
Thodkyaat sangaycha tar
- Beyond sections 43 and 66, know 65, 67, 69, 70B, 72, 79 – and that 66A was struck down in 2015.
- BNS, BNSS and BSA replaced IPC, CrPC and the Evidence Act from 1 July 2024; electronic evidence needs proper certification.
- CERT-In requires specified incidents to be reported within 6 hours and logs kept for 180 days.
- The DPDP Act, 2023 makes organisations protect personal data, with very large penalties.
- Most frauds use fear or greed plus urgency; call 1930 and file on cybercrime.gov.in fast.
Samjla ka? Kayda ani fraud awareness he pratyek security professional che kartavya aahe. Pudhchya chapter madhe careers, certifications ani bug bounty – ya kshetrat job kasa milvaycha. Chala pudhe, mitrano!