Malware Posing as Indian Air Force Invites: Legal Remedies Under the IT Act, BNS, and Reporting in Mumbai

Introduction: The Anatomy of the Threat

Recent threat intelligence reports have highlighted a concerning cyber-espionage campaign targeting India's defense and energy ecosystems. Malicious actors have deployed spear-phishing emails containing weaponized lures disguised as official invitations and circulars from the Indian Air Force (IAF). When opened, these deceptive attachments—often carrying double extensions or embedding macro-enabled code—deploy custom Remote Access Trojans (RATs) and info-stealers designed to exfiltrate proprietary technical data, credentials, and network schematics.

For defense public sector undertakings (DPSUs), strategic energy suppliers, and private supply-chain vendors across commercial hubs like Mumbai, Thane, and the wider Mumbai Metropolitan Region (MMR), this represents an escalating national security and operational liability. Beyond IT containment, organizations caught in the crosshairs of such attacks must navigate complex legal frameworks, regulatory reporting mandates, and statutory evidence preservation rules under Indian law.

Threat Mechanism: Weaponized Communications & Supply-Chain Targeting

Spear-phishing attacks exploiting high-trust entities like the armed forces rely on cognitive deception. The attacker targets individuals within procurement, strategic partnerships, engineering, and administrative departments of critical infrastructure bodies and their third-party contractors.

The vector typically proceeds as follows:

Social Engineering & Impersonation: Attackers spoof official military domains or use look-alike webmail addresses to issue an urgent invitation, conference schedule, or operational circular.
Payload Delivery: The communique carries an attachment (such as an .iso, weaponized .pdf, or macro-laden .docx) or a URL redirecting to a credential-harvesting portal.
Persistence & Exfiltration: Once executed, the malicious script evades endpoint detection, establishes command-and-control (C2) communication, escalates privileges, and begins mapping internal energy grid controllers (SCADA/ICS) or defense research files.

While the technical response requires immediate network segmentation and incident triage, the legal exposure begins the moment a compromise occurs.

The Indian Legal Framework Governing State-Level Cyber Attacks

Cyber attacks on defense, public utilities, and infrastructure are not merely civil wrongs or ordinary cyber crimes; they cross into offenses against national sovereignty, economic security, and public order.

1. Information Technology Act, 2000 (IT Act)

Section 43 read with Section 66: Penalizes unauthorized extraction, downloading, copying of data, disruption of computer systems, and introducing computer contaminants (malware). Penalties include imprisonment up to three years and fines.
Section 66F (Cyber Terrorism): When an attack targets computer systems with the intent to threaten the unity, integrity, security, or sovereignty of India, or strikes critical infrastructure (such as defense facilities, power plants, and energy distribution grids), the offense falls squarely under Section 66F. The statutory punishment extends to life imprisonment.
Section 70 (Protected Systems): The Central Government notifies critical infrastructure facilities as "Protected Systems" through the National Critical Information Infrastructure Protection Centre (NCIIPC). Any unauthorized access or attempt to access a protected system attracts severe imprisonment of up to ten years.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

With the transition from the Indian Penal Code to the Bharatiya Nyaya Sanhita, 2023 (BNS), corresponding provisions apply to electronic offenses:

Section 318 & 319 (Cheating and Cheating by Personation): Applicable when attackers impersonate public servants, armed forces officers, or government departments.
Section 336 & 338 (Forgery and Forged Documents): Fabricating official IAF letterheads, signatures, and electronic communications constitutes criminal forgery of public records.
Section 152 (Acts Endangering Sovereignty, Unity, and Integrity of India): Where state-sponsored espionage seeks to destabilize defense preparedness or critical energy supply, perpetrators commit offenses endangering national security.

3. Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Digital evidence management has been codified under the Bharatiya Sakshya Adhiniyam, 2023 (replacing the Indian Evidence Act, 1872). Sections 61, 62, and 63 of the BSA govern the admissibility of electronic records.

For a victim company in Mumbai or Thane, internal log files, server dumps, raw packet captures, and email headers must be collected under strict chain-of-custody protocols. An evidentiary certificate under Section 63(4) of the BSA is mandatory to make electronic logs legally admissible in court during trial.

Mandatory Compliance: CERT-In Reporting Directives

Organizations operating in the defense and energy sectors, as well as intermediaries, data centers, and corporate entities, are governed by the CERT-In (Indian Computer Emergency Response Team) Directions of April 28, 2022, issued under Section 70B(6) of the IT Act:

Mandatory 6-Hour Reporting Window: Cyber incidents involving targeted scanning, compromise of critical systems, unauthorized access to systems/data, and attacks on infrastructure must be reported to CERT-In within six hours of noticing the incident.
Log Retention Mandate: System logs within Indian jurisdictions must be securely maintained for a rolling period of 180 days.
Non-Compliance Penalties: Failure to report cyber incidents under Section 70B(7) can invite criminal penalties, including imprisonment up to one year and statutory fines.

Practical Steps: How Victims in Mumbai, Thane, and Mira Road Can Report

If an enterprise, vendor, or contractor in the Mumbai metropolitan belt detects a compromise involving forged defense sector correspondence, the following response protocol should be followed immediately:

Step 1: Technical & Evidentiary Preservation

Isolate the affected terminal or virtual machine from the local network and internet without powering it down (to preserve volatile memory / RAM).
Export full email headers, SMTP routing metadata, and raw attachment binaries into hash-verified storage (SHA-256).
Maintain an audit trail of which internal personnel handled the file, securing evidentiary compliance under Section 63 of the BSA.

Step 2: National Cyber Crime Reporting Portal (NCRP)

Log the incident on the central portal: cybercrime.gov.in.
For urgent containment or immediate guidance, call the National Cyber Crime Helpline at 1930.

Step 3: Engaging Mumbai Metropolitan Cyber Police Stations

Corporate victims in Mumbai, Thane, and Mira Road should submit a formal complaint to the specialized Cyber Police Stations rather than general local police stations:

Mumbai Cyber Crime Police Station (BKC): Located at Bandra-Kurla Complex, this station exercises jurisdiction over sophisticated corporate and critical infrastructure intrusions across Mumbai.
Regional Cyber Police Stations in Mumbai: Specialized cells exist for South, Central, Western, Eastern, and Northern regions (e.g., North Cyber Police Station in Kandivali, handling cases for North Mumbai up to Dahisar).
Thane Cyber Police Station: Located within the Thane Police Commissionerate, handling offenses covering Thane city, Wagle Estate, and surrounding industrial hubs.
Mira-Bhayandar-Vasai-Virar (MBVV) Cyber Cell: For businesses and individuals located in Mira Road and Bhayandar, incidents should be reported to the MBVV Cyber Police Station.

Drafting this complaint requires precision: cite the exact technical markers (IP addresses, hash values, headers) alongside the applicable sections of the IT Act and the BNS to ensure registration of an First Information Report (FIR) rather than a mere non-cognizable (NC) register entry.

Risk Mitigation for Vendors in the Strategic Supply Chain

Private entities in Thane, Navi Mumbai, and Mumbai supplying engineering goods, logistics, software, or consultancy to the defense and energy sectors must implement structural defenses:

Vendor Due Diligence & Third-Party Audits: Ensure sub-contractors comply with basic cybersecurity hygiene (MFA, DMARC/DKIM/SPF email authentication).
Zero Trust Architecture: Segment operational technology (OT) from corporate IT networks, preventing lateral movement if an administrative email account is compromised.
Contractual Liability Clauses: Contracts with critical infrastructure partners must clearly define liability, data protection indemnities, and coordinated breach disclosure windows.

Frequently Asked Questions (FAQs)

1. What qualifies an attack as 'Cyber Terrorism' under Section 66F of the IT Act?

Under Section 66F, an act constitutes cyber terrorism if a person denies authorized access, attempts to penetrate, or introduces a contaminant into a computer resource with the intent to threaten the unity, integrity, or sovereignty of India, or to strike terror in people, or if it disrupts supplies and services essential to life or critical infrastructure.

2. Can our company face regulatory action if an employee opens a phishing email?

An inadvertent click by an employee is an incident, not necessarily a criminal offense by the company. However, if the company fails to maintain required security controls, ignores mandatory CERT-In 6-hour incident reporting, or fails to retain 180-day logs, regulatory sanctions under Section 70B of the IT Act and contractual penalties for breach of non-disclosure agreements (NDAs) can follow.

3. How does Section 63 of the Bharatiya Sakshya Adhiniyam (BSA), 2023 affect digital evidence?

Section 63 BSA sets forth conditions for the admissibility of electronic records. Any digital logs, server forensics, or printouts submitted to the police or courts must be accompanied by a formal Section 63 certificate signed by the person in lawful management or operation of the computer device or an authorized expert, certifying system integrity and chain of custody.

4. Which police station should an enterprise in Mira Road approach for cyber intrusions?

Enterprises in Mira Road should report to the Mira-Bhayandar-Vasai-Virar (MBVV) Cyber Police Station or lodge an initial report on the national portal (cybercrime.gov.in). Depending on the cross-jurisdictional scale of the attack, the matter may be escalated to the Maharashtra State Cyber Headquarters.

Consult APS Law on Cyber Legal Compliance & Incident Response

Navigating advanced cyber incidents requires a coordinated strategy combining forensic readiness, regulatory reporting, and robust criminal litigation. APS Law assists corporate entities, defense contractors, and technology vendors across Mumbai, Thane, and Mira Road with CERT-In compliance, digital evidence preservation under the BSA, and filing formal cyber crime representations before specialized cyber cells.

If your organization has encountered a potential security incident or requires assistance auditing internal cybersecurity policies, contact APS Law today to schedule a consultation with our cyber law practice.