Surat/Patna, Aug 11 (SocialNews.XYZ) The Surat City Cyber Crime Cell has arrested four alleged members of a Jamtara-based cyber fraud network from a hotel in Patna after tracing a fake “PNB One.APK” file used to siphon Rs five lakh from a local victim, with the investigation so far uncovering 336 malicious APK files linked to 31,174 installations, 5,613 compromised devices and cyber fraud worth Rs 125.39 crore across the country.
The arrests followed a technical investigation into a complaint relating to a Rs five lakh fraud reported in May. According to the police, the victim received a fake “PNB One.APK” file through WhatsApp.
Once installed, the application allowed the accused to gain access to the phone and subsequently transfer Rs five lakh from the victim’s bank account without their knowledge.
An FIR was registered at the Surat Cyber Crime Police Station under sections 318(4), 336(2), 338, 336(3), 340(2), 61(2), 3(5) of the Bharatiya Nyaya Sanhita, 2023, and sections 66(c) and 66(d) of the Information Technology Act.
Additional Commissioner of Police (Crime) Karanraj Vaghela said the investigation was initially focused on tracing the developer of the APK file.
Technical analysis led police to Uttar Pradesh, where they had earlier arrested Rohit, a resident of Kasganj district, who was allegedly the main developer supplying fake APK files to cyber criminals.
“Rohit was a developer who prepared APK files according to the demands of different cyber criminals. Whether it was SBI, Punjab National Bank, Axis Bank, HDFC Bank or UCO Bank, or names such as hospitals, RTO challans and customer support, he developed files designed to mislead victims and allow cyber criminals to access their accounts,” Vaghela said.
Police said analysis of Rohit’s laptop and mobile phone indicated that he had developed and supplied more than 121 APK files, with data linked to around Rs 64.38 crore in cyber fraud.
His interrogation and subsequent technical analysis led investigators to a gang operating from Jamtara in Jharkhand. The Surat cyber cell team then travelled around 1,970 km to Jamtara and began searches in remote areas.
During the operation, technical surveillance indicated that the alleged main accused, Jahur Ansari alias Chand, was travelling by train.
Police followed him from Jamtara to Deoghar and then to Patna, travelling by road and train, before locating the suspects at a hotel in Patna. The entire operation involved a journey of about 2,456 km.
The four arrested accused have been identified by police as Jahur Ansari alias Chand, 35, of Jamtara; Rajan Kumar, 19, of Aurangabad, Bihar; Adityaraj alias Aman, 19, of Rohtas, Bihar; and Sameer alias Shaktiman, 28, of Jamtara.
Police described Chand as a key link in the network and an alleged buyer and distributor of APK files.
Investigators said he had purchased about 1,248 APK files with source code from developers, paying around Rs 8,000 per file, and sold them to members of the Jamtara network for about Rs 10,000 each.
The fake “PNB One.APK” involved in the Surat case was also allegedly supplied by him. Rajan and Adityaraj were allegedly involved in developing and modifying APK files.
Police said they had learnt the process from the previously arrested developer in Kanpur and subsequently supplied files to Chand.
Adityaraj allegedly edited and changed the designs of APK files and received payments for preparing files with source code. Sameer was allegedly involved as a technical supplier and distribution partner, providing source codes and helping distribute the APK files.
The investigation found that the network operated as a "supply chain". Developers allegedly sold APK files to intermediaries, who then distributed them to cyber criminals.
Police said files were created in the names of banks, government schemes, RTO challans, customer support services and hospitals, among others, and circulated through WhatsApp and Telegram.
Once installed, the fake applications could provide access to a victim’s SMS messages, contacts, call logs and photo gallery, as well as banking information.
Police said the stolen banking details were then used to transfer money into mule bank accounts and mule credit cards, from where the proceeds were allegedly converted into cash and moved through other accounts to conceal the trail.
The analysis of 336 APK files linked to the arrested accused showed that the applications had been installed on 31,174 mobile devices.
Police found evidence that 5,613 of these devices had been accessed, with 1,06,643 debit transactions involving a total of Rs 1,25,39,48,187, or about Rs 125.39 crore.
The individual analysis of APK files linked to Chand included 59 RTO Challan files associated with 11,056 installations and fraud transactions totalling about Rs 42.32 crore; 49 SBI files linked to 5,303 installations and about Rs 31.15 crore; and 37 PNB files associated with 2,548 installations and about Rs 10.77 crore.
The analysis also covered fake applications using the names of Axis Bank, Bandhan Bank, HDFC Bank, YONO, UCO Bank, PM-Kisan, Punjab & Sind Bank, City Union Bank, Canara Bank, Union Bank, customer support services, hospitals and other services.
Vaghela said the technical team had analysed only 336 of the approximately 1,248 APK files linked to Chand so far. “From these 336 APK files, we have found that links were sent to around 31,000 people. After their mobile data and banking information were accessed, around bank transactions were carried out, involving cyber fraud of Rs 125 crore,” he said.
According to police, Chand and other members of the network allegedly moved the proceeds from victims’ accounts to mule accounts and mule credit cards before cashing them out.
Police said the suspects had left Jamtara after learning through Surat City Police’s social media accounts that Rohit, the alleged developer, had been arrested.
The four then remained on the move before being traced to Patna. Six mobile phones and one laptop were seized from the four accused.
Police said further investigation was under way into the financial links and other members of the network.
Police have advised people not to install APK files received through unknown WhatsApp messages, SMS, or other links, and to download applications only from the official Google Play Store or App Store platforms.
They have also warned against sharing banking credentials, ATM or card details, UPI PINs, net-banking passwords or OTPs.
Victims of cyber fraud have been advised to immediately call the national cybercrime helpline 1930 or report the incident through the National Cyber Crime Reporting Portal.
Source: IANS
About Gopi
Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.
He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.
When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.
He can be reached at gopi@socialnews.xyz