CloudSEK, a cybersecurity agency, has revealed a network involved in the production and distribution of counterfeit Indian currency. According to the firm, the syndicate was promoting fake notes through social media platforms, including Facebook and Instagram, and utilized legitimate marketing strategies such as Meta advertisements. The report indicates that the group circulated fake currency valued at Rs. 17.5 crore over the past six months. During its investigation, CloudSEK successfully identified the group’s leaders and their geographical locations.
CloudSEK Utilizes OSINT and HUMINT Techniques to Uncover Perpetrators
In a press release, CloudSEK’s Strike team articulated details of their investigation into the counterfeit currency operation that functioned openly on social media. The cybersecurity experts discovered the methods the group employed to create counterfeit notes and how they marketed these illicit offerings using their XVigil platform. Through this endeavor, researchers identified the group administrators’ faces and their locations.
According to the report, the syndicate was active on various platforms, including Facebook, Instagram, Telegram, and YouTube, where they ran extensive marketing campaigns. They also engaged in paid promotions through Meta ads to attract potential buyers. The group utilized Facebook and Telegram groups, applying codewords like “second currency” and “A1 note.” CloudSEK noted that some sellers even attempted to establish the authenticity of their counterfeit items through videos, handwritten notes, and video calls.
During the investigation, CloudSEK identified over 4,500 promotional posts, more than 750 accounts and pages linked to the sales, and around 410 unique phone numbers associated with the sellers.
CloudSEK detailed the operation’s mechanics, stating that the perpetrators produced high-quality replicas of Indian currency using Adobe Photoshop and industrial-grade printers, along with paper featuring Mahatma Gandhi’s watermark and embedded green security threads. After promoting their counterfeit notes, the group shared proof images with buyers via WhatsApp and even facilitated video calls to display stacks of fake currency. However, transactions were conducted in person rather than online. The group employed burner phones, fake identification, and aliases to elude law enforcement.
The researchers were able not only to assess the breadth of the group’s activities but, through open-source intelligence (OSINT) and human intelligence (HUMINT) strategies, to ascertain the identities and locations of the group leaders. This involved collecting facial images, phone numbers, GPS data, and social media profiles of key suspects, who were identified as residing in Jamade Village, Dhule district in Maharashtra, and Pune.
CloudSEK has formally communicated the findings of its investigation to law enforcement agencies at both the state and national levels. The firm recommends that Meta actively monitor its Ad libraries to eliminate such fraudulent financial activities. Furthermore, it encourages authorities to collaborate with social media platforms to dismantle the identified sellers and groups.
