Russian Hackers Spreading DanaBot and Stealc via Fake Brand Sites: Threat Explainer and Legal Remedies in India

Introduction: The Rising Menace of Brand Impersonation and Information Stealers

Global cybersecurity researchers have observed a sharp spike in sophisticated cyber campaigns attributed to Russian-speaking threat actors utilizing fraudulent brand websites to distribute dangerous infostealers and Trojans, specifically DanaBot and Stealc. These campaigns weaponize search engine advertising and SEO poisoning (malvertising) to pose as trusted software vendors, utility tools, AI applications, or corporate remote-work suites.

For businesses, professionals, and individual users across India—particularly in commercial and financial centers such as Mumbai, Thane, and the emerging tech corridor of Mira-Bhayandar—this threat vector poses severe operational, financial, and legal risks. In this explainer, APS Law breaks down how these attacks operate, examines the statutory remedies available under Indian cyber and criminal jurisprudence, and outlines the precise procedure for reporting incidents to local law enforcement.

Understanding the Attack: How DanaBot and Stealc Infiltrate Systems

To counter cyber attacks effectively, victims and corporate counsel must understand how threat actors breach standard digital defenses.

1. Typosquatting and Malvertising

Attackers purchase domain names visually identical or confusingly similar to legitimate software applications (e.g., popular PDF editors, remote desktop software, or AI image generators). They run paid advertisements on major search engines so that unsuspecting users searching for software see the fraudulent link ranked at the top of their search results.

2. Payload Delivery: DanaBot and Stealc

Once a user downloads what they believe to be an authentic setup file, the system executes a dual-stage payload:

DanaBot: A modular banking Trojan first identified in 2018, continuously updated by Russian-speaking developers. It can inject malicious scripts into web browsers, sniff network traffic, exfiltrate banking credentials, and provide remote shell access to compromise entire corporate intranets.
Stealc: A lightweight, aggressive information stealer that targets web browser data. It systematically siphons stored passwords, autofill data, credit card information, browser session cookies, and cryptocurrency extension wallets. It is often sold on underground darknet forums as Malware-as-a-Service (MaaS).

3. Immediate Consequences

Once deployed, threat actors gain persistent access to corporate networks, enabling corporate espionage, account takeovers (ATO), unauthorized financial transfers, or subsequent ransomware extortion.

The Indian Legal Framework: Addressing Malware Attacks and Identity Theft

When a workstation or corporate network in India is compromised by foreign or domestic malware campaigns, Indian criminal and digital statutes provide dual avenues of redress: criminal prosecution and civil compensation.

1. Information Technology Act, 2000 (IT Act)

The IT Act remains India's foundational cyber statute:

Section 43: Prescribes civil liability and damages by way of compensation for unauthorized access, downloading, extracting data, or introducing any "computer contaminant" or computer virus into a computer system.
Section 66: Criminalizes any dishonest or fraudulent act falling within Section 43, carrying imprisonment of up to three years or a fine up to five lakh rupees, or both.
Section 66C (Identity Theft): Imposes penalties for fraudulently using another person's electronic signature, password, or unique identification feature—squarely applicable when stealer malware extracts browser-stored credentials.
Section 66D (Cheating by Personation): Penalizes cheating by personation through any computer resource or communication device, directly punishing the deployment of fake brand websites designed to deceive end users.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following India's criminal law overhaul, offences formerly prosecuted under the Indian Penal Code (IPC) now fall under the Bharatiya Nyaya Sanhita, 2023 (BNS):

Section 318 of BNS (Cheating): Replaces Section 420 IPC, punishing fraudulent deception inducing a person to deliver property or consent to the retention of data.
Section 319 of BNS (Cheating by Personation): Replaces Section 416/419 IPC, covering instances where criminals set up clone sites pretending to be legitimate brands.
Section 336, 338, and 340 of BNS (Forgery and False Electronic Records): Applies to creating fraudulent web pages and digital installers masquerading as original vendor packages.
Section 61 of BNS (Criminal Conspiracy): Invoked where malware distribution networks involve multi-actor syndicates.

3. Evidentiary Standards under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Proving malware infiltration requires forensic logs, server dumps, and digital chain of custody. Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA)—which replaced the Indian Evidence Act—electronic records are governed by Section 61 and Section 63. When submitting forensic reports, browser history, and network captures to investigative agencies or courts, a properly executed certificate under Section 63 of the BSA is mandatory to ensure admissibility.

Immediate Steps and Reporting Recourse for Victims in Mumbai, Thane, and Mira-Bhayandar

If you or your organization suspects a DanaBot or Stealc infection, rapid legal and technical containment is critical.

Step 1: Technical Isolation and Evidence Preservation

Disconnect infected devices from the local area network (LAN) and Wi-Fi immediately to prevent lateral movement.
Do not immediately format or wipe the machine. Forensic copies (disk images and RAM dumps) must be preserved for evidentiary purposes under the BSA.
Revoke active browser sessions, reset enterprise passwords from a clean device, and invalidate all multi-factor authentication (MFA) tokens.

Step 2: Immediate Financial Fraud Freezing (Helpline 1930)

If financial credentials or funds have been exfiltrated, immediately dial the National Cyber Financial Fraud Helpline at 1930 or log on to cybercrime.gov.in. Prompt reporting enables the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) to freeze transit accounts before illicit transfers are withdrawn.

Step 3: Registering a Complaint with Local Cyber Police Stations

Victims in the Mumbai Metropolitan Region (MMR) should register a formal police complaint (Zero FIR under the Bharatiya Nagarik Suraksha Sanhita, 2023 - BNSS) at the appropriate jurisdictional cyber police station:

Mumbai Jurisdictions: Depending on the zone, victims can approach the Cyber Police Station at Bandra-Kurla Complex (BKC) (often handling major corporate frauds) or regional cyber police stations located in South (Worli), Central (Worli), West (Bandra), North (Kandivali), and East (Ghatkopar).
Thane: The Thane Cyber Crime Cell, located near the Commissioner of Police Office, Thane (West), exercises jurisdiction over cyber offences across Thane City.
Mira Road & Bhayandar: Victims in Mira Road, Bhayandar, Vasai, and Virar fall under the Mira-Bhayandar Vasai-Virar (MBVV) Police Commissionerate. Complaints should be addressed to the MBVV Cyber Police Station.

Step 4: Initiating Adjudication for Civil Damages

Beyond criminal proceedings, corporate or individual victims can file a petition before the Adjudicating Officer appointed under Section 46 of the IT Act (typically the State IT Secretary). This quasi-judicial forum can award compensation against perpetrators or negligent intermediaries for damages suffered due to unauthorized computer contamination.

Frequently Asked Questions (FAQs)

1. Can Indian law enforcement prosecute Russian or foreign cyber criminals?

While cross-border enforcement is challenging, Indian agencies can register an FIR, seek Letters Rogatory (LRs), or issue Interpol Red Notices through the Central Bureau of Investigation (CBI), India's National Central Bureau. Additionally, domestic intermediaries (such as advertising platforms or local web hosts) may be legally compelled under Section 94 of the BNSS and Section 69 of the IT Act to furnish IP logs and transaction data.

2. What is the difference between an entry on cybercrime.gov.in and a formal FIR?

A report on the National Cyber Crime Reporting Portal serves as an initial incident log. For serious offences involving substantial financial theft or data compromise, the police must convert the incident into a formal First Information Report (FIR) under Section 173 of the BNSS to initiate a formal statutory investigation.

3. How does the Bharatiya Sakshya Adhiniyam, 2023 affect digital evidence submission?

Under Section 63 of the BSA, parties submitting electronic records (such as network audit trails, firewall logs, or email communications) must accompany them with an electronic evidence certificate signed by the person in lawful charge of the computer resource or an authorized expert. Failure to supply this certificate renders the evidence inadmissible during trial.

4. What liability does a company face if an employee downloads Stealc onto a work laptop?

Under the newly enacted Digital Personal Data Protection Act, 2023 (DPDPA), data fiduciaries are obligated to implement reasonable security safeguards. If an infostealer compromises customer personal data, the organization could face regulatory scrutiny and penalties from the Data Protection Board of India for failing to maintain adequate cybersecurity hygiene.

Legal Support from APS Law

Navigating a cyber intrusion requires a coordinated legal and regulatory response. APS Law represents corporate entities and individuals across Mumbai, Thane, and Mira Road in cyber litigation, statutory reporting, cyber fraud recovery, and compliance under the IT Act and new criminal codes.

If your organization has suffered a security breach or needs proactive guidance on cyber law compliance, contact APS Law today to schedule a confidential consultation.