Gujarat ATS arrests espionage agent who compromised mobile devices of defence personnel

In a major breakthrough, the Gujarat Police Anti-Terrorism Squad (ATS) arrested a 53-year-old espionage agent named Labhsankar Maheshwari from Tarapur, Gujarat, on Thursday. This development follows specific information provided by the Military Intelligence (MI).

Earlier in July, MI officials uncovered a covert operation by a Pakistani Intelligence Operative (PIO) who used the WhatsApp number 90xxxx6792 to compromise the Android mobile devices of serving defence force personnel. The targets primarily consisted of parents with children attending various Army Public Schools (APS) across India. The PIO posed as an APS official and sent malicious Android applications (".apk" files) disguised under a campaign named "Har Ghar Tiranga" just before Independence Day. Recipients were encouraged to install the applications and upload their children's photos with the national flag to participate in the competition.

How the arrest was made

After tracing the last use of the mobile number 90xxxx6792 to Gujarat, MI sought the assistance of the ATS in Gujarat. A comprehensive technical analysis and investigative work by the Gujarat Police ATS led to the identification of Labhsankar Maheshwari as the prime suspect. He is alleged to have assisted the Pakistani agency in acquiring the Indian WhatsApp number by providing the OTP for account creation to the Pakistani agency.

With the support of Air Force Intelligence, the Gujarat Police ATS accurately identified one of the targeted Android devices, which was subsequently subjected to cyber forensic examination. The examination revealed that the WhatsApp number 90xxxx6792, originating from Pakistan, had targeted and hacked mobile devices belonging to Indian Defense personnel to gather critical information.

There are suspicions that the Pakistani agency obtained significant information about APS students and their guardians through existing vulnerabilities in the school's website or the "DigiCamps" Android application, commonly used for fee payments. These APS institutions are part of the Army Welfare Education Society (AWES), a private organization supported by the Indian Army.

Following the collection of substantial evidence and additional information through ground verification, the Gujarat Police ATS filed a First Information Report (FIR) invoking relevant sections of the Indian Penal Code and the Indian IT Act. The prime suspect, Labhsankar Maheshwari, was arrested from his residence in Tarapur, Anand district, Gujarat, on Thursday.

Arrived in India in 1999, acquired citizenship in 2006

During preliminary questioning, it was revealed that Labhsankar Maheswari is originally a Pakistani Hindu who arrived in India in 1999 with his wife for fertility treatment. After establishing himself in Tarapur with the support of his in-laws, he and his wife were granted Indian citizenship in 2006. In early 2022, the accused visited his parents in Pakistan and is believed to have been cultivated during his visa processing. Since then, he has maintained communication with a Pakistani intelligence agency. In addition to facilitating the creation of the WhatsApp account, he sent the SIM card to Pakistan and provided other assistance to the hostile agency, including money transfers to suspected espionage conduits on behalf of the Pakistani agency.

The WhatsApp number 90xxxx6792, facilitated by Labhsankar, was exploited by the Pakistani agency to compromise multiple mobile devices belonging to Indian citizens, most of whom were associated with security forces. This activity was in violation of the Indian IT Act.

Further investigations into the extent of the accused's involvement with the Pakistani intelligence agency and the damage caused are being jointly analyzed by MI and the Gujarat Police ATS. The latter is expected to seek police custody of the accused in a local court shortly.

The arrest of this espionage agent is a significant success for Indian security agencies, as it has exposed the malicious designs of Pakistani intelligence agencies. This development is expected to help prevent further losses of critical information through compromised mobile devices and serve as a deterrent to nefarious hacking efforts by hostile agencies or entities targeting information assets related to security forces and the common Indian citizen.

For Indian Android phone users who received a similar ".apk" file from WhatsApp number 90xxxx6792 or a similar one, attempting to install the application, it is advised to perform a 'factory reset' to prevent further data loss from their devices.