The Malware Attack That Became India’s Biggest Cybercrime

Long Reads / Long Reads Homepage / Long Reads Politics

How an unsophisticated malware attack became India’s biggest state-sponsored cybercrime

This is the third report in a three-part investigative series on the Elgar Parishad/Bhima Koregaon case. Read part one here and part two here.

By Mouli Sharma and Prashant Rahi

March 26, 2025

In October 2014, five months after the arrest of the professor GN Saibaba, Stan Swamy’s computer was hacked. Unbeknown to the world, the nascent stages of investigation against the prime accused in the Elgar Parishad case, who came to be monikered the BK-16, had already begun in 2014—four years before any of the arrests even took place. The unknown attacker used a Remote Access Trojan—or RAT—sent through targeted phishing emails to compromise Swamy’s computer. A Trojan is a type of malware that downloads onto a computer disguised as a legitimate programme. The virus found in Swamy’s computer, then a recent but exciting entry into the world of commercial malware, would go on to become one of the most notorious Trojans of the 21st century: NetWire. At that time, both the attacker and their chosen malware were threat elements on the lower tiers of the cybercrime trade in terms of both…

Purchase Membership

Join us

Mouli Sharma

Mouli Sharma is a scholar of religion at Jamia Millia Islamia and a freelance journalist from New Delhi. Her work has appeared in Nivarana, Think Global Health, Feminism in India, The Leaflet, and NewsClick. She is a published photojournalist & illustrator and has been featured in The Hindu College Gazette and the quarterly Pink Disco. She is the editor-in-chief of the student-run news site, The Voice Express, and is a literary editor for the digital lit-mag, The Queer Gaze.

Prashant Rahi

Prashant Rahi is an electrical and systems engineer, who completed his education from IIT, BHU, before eventually becoming a journalist for about a decade in Uttar Pradesh and Uttarakhand. He was the Chairperson for Human Rights and Democracy at the annual Indian Social Science Congresses held between 2011 and 2013, contributing to the theorisation of social activists’ and researchers’ experiences. Rahi devoted the greater part of his time and energy for revolutionary democratic changes as a grassroots activist with various collectives. For seven years, he worked as a Correspondent for The Statesman, chronicling the Uttarakhand statehood movement, while also participating in it. He has also contributed political articles for Hindi periodicals including Blitz, Itihasbodh, Samkaleen Teesri Duniya, Samayantar and Samkaleem Hastakshep. From his first arrest in 2007 December in a fake case, where he was charged as the key organiser of an imagined Maoist training camp in a forest area of Uttarakhand, to his release in March 2024 in the well-known GN Saibaba case, Rahi has been hounded as a prominent Maoist by the state for all of 17 years. In 2024, he joined The Polis Project as a roving reporter, focusing on social movements.