Gujarat cyber crime probe exposes international Boss Scam network; links with China, Pakistan

Key points

• Technical analysis of around 4,500 SIM cards led investigators to examine 251 complaints filed on the National Cyber Crime Reporting…
• Through this coordinated action, more than 10,000 infected devices were secured, and Indian citizens were rescued from potential losses of…
• Investigators identified the alleged role of Imran Ali Piyada, a B.A. graduate who worked as a sales agent for telecom…
• Investigators said the fraud began with the accused posing as office-holders of the Reserve Bank of India or another government…

AHMEDABAD: The cyber crime cell of Gujarat has traced two accused allegedly linked to a sophisticated “Boss Scam” in which WhatsApp Web sessions were hijacked and company CEOs impersonated to problem urgent payment instructions to employees in government finance and accounts departments.

Investigators identified the alleged role of Imran Ali Piyada, a B.A. graduate who worked as a sales agent for telecom service providers including Airtel, Jio, Vi and BSNL.

Technical analysis of around 4,500 SIM cards led investigators to examine 251 complaints filed on the National Cyber Crime Reporting Portal from 26 states.

While another accused, Injmul, allegedly coordinated with people involved in cyber fraud, police said Piyada allegedly employed dummy SIM cards, mobile numbers and OTPs.

What happened

Both accused were traced to West Bengal through technical analysis during the investigation. The probe was conducted following directions from Ahmedabad Police Commissioner Anupam Singh Gehlot and under the supervision of senior officers of the Crime Branch and Cyber Crime Branch.

Investigators said the fraud began with the accused posing as office-holders of the Reserve Bank of India or another government institution. They allegedly sent ZIP files to company CEOs, directors or employees through WhatsApp or email, claiming they contained notable official documents.

The.exe and.dll files allegedly contained malicious executable files. Once opened on a computer, the files enabled the accused to gain control of the victim’s WhatsApp Web session, investigators said.

Impersonation of senior officials

The details

The operation then shifted from hacking to impersonation. The accused allegedly saved their own mobile number under the name of the CEOs or directors, used the senior executive’s profile photograph and created the appearance that messages were being sent by the company’s top management.

The impersonator then allegedly sent urgent instructions to employees in the accounts or finance department, directing them to transfer money on the pretext of an immediate financial requirement.

Investigators said the deception became harder to detect as the original numbers of the CEOs or bosses were allegedly deleted and replaced with the fraudster’s numbers saved under the same name. Employees, believing the message was from their superior, would transfer funds without independently confirming the instruction.

Dummy SIMs formed backbone of the operation

Why it matters

At the centre of the network was an alleged chain involving dummy SIM cards, mobile numbers, OTPs and WhatsApp accounts.

Investigators described the suspected process as: Dummy SIM card → mobile number →OTP → WhatsApp account → WhatsApp hijacking or impersonation → fake CEO instruction → money transfer.

According to the Cyber Crime Cell, dummy SIM cards were activated on mobile phones and their numbers were subsequently supplied to people allegedly involved in cyber fraud. When WhatsApp accounts were activated on those numbers, the OTPs required for registration were received on the dummy SIM cards and allegedly passed on to the concerned cyber criminals.

According to the investigation, Piyada allegedly misused customers’ biometric fingerprints and telecom service-provider applications to obtain SIM cards in customers’ names. He then allegedly activated mobile numbers on SIM cards of another company without the customers’ knowledge, creating what investigators described as dummy SIM cards.

Background

These SIM cards were allegedly inserted into different mobile phones and activated by Piyada. The resulting mobile numbers were then supplied to people involved in cyber fraud.

Investigators further reported that Piyada played a crucial role in creating a digital communication infrastructure as he received WhatsApp activation OTPs on the dummy SIM cards in his possession and passed those OTPs to the persons using the numbers, enabling them to activate WhatsApp accounts.

Five-year OTP racket & China connection

The investigation has also disclosed an alleged wider OTP-selling operation. According to police, Piyada used dummy SIM cards for e-commerce platforms such as Amazon and Flipkart as well as online gaming applications and allegedly sold OTPs generated for such services.

What comes next

It appears that over five years, the accused sold approximately 21,000 OTPs for e-commerce and online gaming at an average price of Rs 100, thereby obtaining over Rs 21,00,000, and sold approximately 900 OTPs for activating WhatsApp accounts at an average rate of Rs 250, thereby obtaining more than Rs 2,25,000.

According to the technical and network analysis conducted by the Indian Cyber Crime Coordination Centre and Ahmedabad Cyber Crime Branch, the malware is suspected to have been developed by cyber criminals associated with “China” and was being used to target Indian citizens for cyber fraud through a call centre located in Islamabad, Pakistan.

The bank accounts involved in the cyber fraud were found to have been accessed through a China-based VPN service. Based on these findings, it has preliminarily emerged that the accused used a multi-country cyber infrastructure associated with China, India, Pakistan and Hong Kong to conceal their identities and actual locations.

Through this coordinated action, more than 10,000 infected devices were secured, and Indian citizens were rescued from potential losses of crores of rupees due to cyber frauds such as the BOSS Scam. Additionally, the malware identified through the Sahyog Portal is being regularly blocked.

More on this story

Injmul acted as coordinator

The second accused, Injmul. This person is also a BA graduate, has allegedly been identified in contact with people involved in cyber fraud activities. During the investigation, police found that Injmul assisted in the apply of mobile numbers, dummy SIM cards and WhatsApp-based communication systems that were used in cyber fraud.

Investigators further alleged that he participated in the use of mobile numbers and WhatsApp accounts activated through dummy SIM cards and coordinated with persons allegedly involved in committing cyber fraud.

Structured cyber fraud ecosystem

The investigation has now widened beyond individual transactions. The complaints were filed by applicants from 26 states nationwide, indicating the potentially wider geographical footprint of the digital network under investigation.

The findings point to a structured cyber fraud ecosystem in which access to SIM cards and OTPs allegedly provided the foundation for WhatsApp account creation, identity impersonation and fraudulent financial instructions.

Gujarat police’s Ahmedabad Cyber Crime Cell is continuing its investigation into the network, its alleged associates and the wider use of the mobile numbers and WhatsApp accounts identified during the technical analysis.