“Companies spend millions of dollars on firewalls, encryption, and secure access devices, and it’s money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, operate and account for computer systems.” -— Kevin Mitnick
By CA Anil K. Jain, Author – ‘Cyber Crimes’
1. Introduction and Overview:
Hacking serves as the foundational mechanism behind modern cyber crimes, enabling financial fraud, identity theft, cyber espionage, election interference, and attacks on critical infrastructure. The modern threat actor ecosystem spans casual hobbyists, organized syndicates, and state-sponsored entities. Dr. Gulshan Rai emphasizes that to understand cybercrime, one must understand the cybercriminal, noting that their mind and keyboard serve as their primary arsenal and weapon.
2. The Hacker Typology:
Black Hat Hackers: Malicious actors who breach computer systems for financial gain, personal revenge, or ideological satisfaction, with prominent hubs appearing across regions like Jamtara and Nuh.
White Hat Hackers (Ethical Hackers): Professionals and independent researchers who identify vulnerabilities to strengthen security systems, contributing heavily to major bug bounty programs run by institutions like the RBI, NPCI, and commercial banks.
Grey Hat Hackers: Individuals who access systems without explicit permission but without direct malicious intent, though their actions remain technically illegal under Section 66 of the IT Act.
Hacktivists: Groups utilizing website defacements, data leaks, and DDoS attacks to conduct political or social protests.
State-Sponsored Hackers and APTs: Advanced Persistent Threat groups backed by nation-states (such as Stone Panda, SideCopy, and the Lazarus Group) that target defence, power grids, and diplomatic missions using zero-day exploits and custom malware.
Script Kiddies: Inexperienced actors who leverage pre-written scripts and dark web tools to execute low-skill attacks like basic defacements and phishing.
Insider Threats: Employees, contractors, or partners who leverage legitimate organisational access to steal data, leak customer records, or compromise enterprise servers.
Cyber Mercenaries: Private entities that sell offensive hacking tools and spyware (such as NSO Group’s Pegasus) to highest-bidder clients in a complex global legal vacuum.
3. Social Engineering and Human Exploitation:
Social engineering manipulates human psychology to bypass technical security controls completely, forming the foundation of the vast majority of financial frauds and UPI scams in India.
Phishing, Spear Phishing, and Whaling: Broad deceptive campaigns, highly targeted emails aimed at specific professionals (such as DRDO scientists), and executive-level whaling attacks.
Vishing (Voice Phishing): Phone-based impersonations of bank personnel or law enforcement, increasingly incorporating AI-generated voice cloning to execute high-value fraud.
Smishing and Baiting: SMS-based malicious link delivery and deceptive free-download lures (such as fake subscription APKs) designed to deploy malware.
Pretexting: Elaborate manufactured scenarios, such as the widespread “FedEx and cyber police drug parcel” scams used to extract banking credentials.
4. Malware Ecosystem and Digital Weapons:
Viruses, Worms, and Trojans: Self-replicating code, network-propagating worms like WannaCry, and banking trojans (such as Anubis and Drinik) disguised as utility or tax refund apps.
Ransomware: Encrypts victim data and demands cryptocurrency payments via Ransomware-as-a-Service models, with notable Indian targets including AIIMS Delhi, Tata Power, and major pharmaceutical firms.
Spyware and Stalkerware: Advanced zero-click surveillance tools like Pegasus alongside commercially available stalkerware used in domestic monitoring.
Banking Trojans, Keyloggers, and Botnets: Mobile overlay trojans, physical/software keyloggers, and massive IoT botnets (like MoChhat and Reaper) used to drain accounts, intercept OTPs, and launch massive DDoS attacks.
File less Malware: Advanced malware operating strictly in system memory via legitimate tools (like PowerShell) to evade traditional antivirus detection.
5. Network, Infrastructure, and Web Application Hacking
Network Attacks: Distributed Denial of Service (DDoS) assaults that overwhelm gateway servers, Man-in-the-Middle (MITM) attacks utilizing rogue Wi-Fi access points (“Evil Twins”), SSL stripping, and DNS spoofing.
Web Vulnerabilities: Pervasive issues including SQL Injection (SQLi), Cross-Site Scripting (XSS), insecure direct object references (IDOR), broken authentication, and API parameter tampering that expose millions of consumer records.
Advanced Exploits & Campaigns: Zero-day vulnerabilities lacking existing patches, watering-hole attacks compromising trusted sector websites, website defacement campaigns, and Magecart-style e-commerce checkout skimmers.
6. Mobile Hacking, Credential Attacks, and Emerging Threats:
Mobile Threat Vector: Over 700 million Indian smartphone users face threats from malicious APKs, overlay screen attacks, SMS interception, call forwarding, and rooting/jailbreaking exploits.
Credential Attacks: Brute-force guessing, credential stuffing exploiting dark web database dumps (from breaches like BigBasket and Domino’s India), and phishing kits sold cheaply on Telegram.
Dark Web and AI-Assisted Hacking: The commercialisation of hacking via exploit kits, Remote Access Trojans (RATs), and Malware/Ransomware-as-a-Service, alongside emerging artificial intelligence capabilities that automate vulnerability discovery and generate hyper-personalized social engineering.
7. Major Case Study: The Cosmos Bank Heist (2018):
The Cosmos Bank cyber heist demonstrated the synchronised execution of multiple hacking techniques in a coordinated multi-layered attack resulting in a ₹94.42 crore loss.
Execution Stages: Initiated via spear-phishing malware delivered through an Excel macro, attackers established a reverse shell, used Mimi Katz to harvest credentials, moved laterally across networks, and compromised the ATM switch and SWIFT terminal.
Final Phase: Fraudulent MT103 SWIFT messages were transmitted to Hong Kong while cloned cards executed coordinated cash withdrawals across 28 countries.
8. Indian Legal Framework and Capacity Building:
Statutory Provisions: The Information Technology Act, 2000, governs cyber offences through Section 43 (civil liability), Section 66 (fraudulent hacking), Sections 66B-66C (stolen devices and identity theft), Section 66F (cyber terrorism), and Section 70 (protected system access). Other relevant statutes include IPC provisions on data theft and virtual trespass, the Official Secrets Act, and the PMLA.
Reporting & Prosecution Challenges: CERT-In directions mandate incident reporting within six hours, while prosecution faces major hurdles in cross-border attribution, suspect anonymity, and strict digital evidence admissibility under Section 65B of the Indian Evidence Act.
Ethical Hacking & Defence: Addressing the acute cybersecurity talent deficit (NASSCOM’s projected 1 million professional gap by 2025) requires robust bug bounty programs, specialised academic programs, government capacity building like Cyber Surakshit Bharat, and fostering an empowered, vigilant digital culture.
9. Conclusion:
As Hackers and Hacking Techniques demonstrates, the threat landscape is defined by a constant arms race between evolving criminal innovations and reactive defences. Whether facing a basic phishing message originating from regional cyber hubs or a complex zero-day exploit chain deployed by a state-sponsored APT group, the underlying reality remains clear: the hacker and the hacking technique are two faces of the same coin. Fuelled by the commercialization of dark web marketplaces, Ransomware-as-a-Service (RaaS), and the accelerating capabilities of artificial intelligence, cybercrime has transformed into an industrial-scale enterprise. Meanwhile, India’s legislative framework—while pioneering at its inception—now requires an urgent and comprehensive modernization through the anticipated enactment of the Digital India Act to counter these sophisticated modern vectors. However, the ultimate defence against this digital shadow economy transcends mere statutes or perimeter security:
BUY NOW: https://cybercrimes.jainsamaj.org
