6 min read
The report noted that beyond jailbreaking, malicious LLMs such as WormGPT and FraudGPT are capable of writing convincing phishing emails and coding highly effective malware programmes. (File photo)Take a look at the essential concepts, terms, quotes, or phenomena every day and brush up your knowledge. Here’s your knowledge nugget for today.
(Relevance: Cybersecurity is an important topic for the UPSC exam. Mains questions in General Studies III have been asked on various elements of cyber security and India’s comprehensive National Cyber Security Strategy. In this regard, this report becomes important for your exam.)
Recently, the Digital Threat Report 2024 for the Banking, Financial Services, and Insurance (BFSI) sector was released by the Indian Computer Emergency Response Team (CERT-In), the Computer Security Incident Response Team in the Finance sector (CSIRT-Fin), and SISA, a global Cybersecurity company. The report has flagged cryptocurrency as a new frontier for cyber threats. It states that while threat actors initially used Bitcoin for illicit transactions, they have since migrated to other cryptocurrencies like Monero (XMR).
1. The report acknowledged the targeting of crypto exchanges by threat actors as a new strategy. WazirX, one of India’s major crypto exchanges, was hit by a cyber attack where hackers allegedly stole nearly half of the platform’s crypto reserves worth more than $230 million. More recently, hackers stole digital assets worth over $1.5 billion from Dubai-based crypto exchange Bybit, in what is said to be the largest crypto heist till date.
2. The report pointed out a new malware variant that scans “infected environments” for crypto wallets or the keys that secure them. It extracts these keys to gain unauthorized access to victims’ crypto assets, leading to financial losses.
3. Deepfakes and AI-generated content are “potent tools for intrusion, particularly in social engineering attacks.” “Deep fake voice and video allow cyber perpetrators to mimic the voices and appearances of executives, employees, or trusted partners,” the report stated.
4. It said that the threat of LLM (large language model) prompt hacking was much more prevalent in applications that host LLMs locally as opposed to developer APIs by providers such as OpenAI and DeepSeek.
5. However, jailbreaking attempts have been successful against OpenAI’s ChatGPT in the past. Jailbraking is the process of removing software restrictions imposed by the device’s manufacturer to install unauthorized software, modify the device’s operating system, and access hidden features. For instance, in 2023, ChatGPT users discovered that they could bypass the AI chatbot’s safeguards by asking it to pretend to be a dead grandmother. This technique came to be known as the ‘grandma exploit’.
6. Beyond jailbreaking, the report noted that malicious LLMs such as WormGPT and FraudGPT are capable of writing convincing phishing emails, coding highly effective malware programmes, and automating the development of exploits.
| FraudGPT |
| FraudGPT is a bot that is used for offences such as creating cracking tools, phishing emails, etc. It can be used to write malicious code, create undetectable malware, detect leaks, and vulnerabilities. The chatbot has been circulating on Dark Web Forums and Telegram since July 22. |
7. In its suggestions for policymakers, the report recommends implementing clear and comprehensive AI regulations to ensure the responsible deployment of AI and ML in the BFSI sector. It also recommended that companies in the BFSI sector subject the APIs within AI-native applications to security testing in order to uncover hidden vulnerabilities.
1. On Thursday, Defence Minister Rajnath Singh said that in the era of “grey zone” and hybrid warfare, cyber attacks and disinformation campaigns have become significant tools to achieve politico-military aims.
2. Also, the Kaspersky report released in February 2025, found that one in every three internet users in India were targeted by web-borne threats last year. Between January and December 2024, the company detected 4,43,72, 823 Internet-borne cyberthreats on computers of users in India.
3. The changing geo-political and economic shifts have compelled the Indian government to take active steps to evolve in cyberspace. This includes key initiatives such as the National Cyber Coordination Centre, Cyber Surakshit Bharat, and National Critical Information Infrastructure Protection Centre. CERT-In, constituted in 20024, is the nodal agency for responding to computer security incidents when they occur.
4. In 2018, the Ministry of Home Affairs established the Indian Cyber Crime Coordination Centre (I4C) as a national-level coordination centre to address cybercrime-related issues. In September 2024, four I4C platforms — Cyber Fraud Mitigation Centre (CFMC), the ‘Samanvaya’ platform, a Cyber Commandos programme and a Suspect Registry — were inaugurated by Home Minister. The centre was able to decline six lakh fraudulent transactions and saved Rs 1,800 crore through Suspect Registry.
5. In recent years, the government has also increased the budget allocation to cybersecurity. However, challenges remain. There is a need for effective utilisation, transparency, and accountability in fund allocation. Collaboration between the government, industry, and academia is vital for a robust approach.
Post read question
In India, it is legally mandatory for which of the following to report on cyber security incidents? (UPSC CSE 2017)
1. Service providers
2. Data centres
3. Body corporate
Select the correct answer using the code given below:
(a) 1 only
(b) 1 and 2 only
(c) 3 only
(d) 1, 2 and 3
| Answer key |
| (d) |
Subscribe to our UPSC newsletter. Stay updated with the latest UPSC articles by joining our Telegram channel – IndianExpress UPSC Hub, and follow us on Instagram and X.
🚨 Click Here to read the UPSC Essentials magazine for March 2025. Share your views and suggestions in the comment box or at manas.srivastava@indianexpress.com🚨
