Gujarat ATS arrests man for facilitating spying on Indian defence personnel using RAT malware

The Gujarat Anti-Terrorist Squad (ATS) on Friday arrested a 53-year-old man for allegedly facilitating an espionage ring for the Pakistani intelligence agency. The suspect is of Pakistan origin and acquired Indian citizenship about a decade back.

ATS officials arrested Labhshankar Maheshwari, a resident of Tarapur in Anand, based on inputs received from the military intelligence agency. Officials said that Maheshwari was allegedly facilitating espionage activities for the Pakistani intelligence agency by installing WhatsApp using an Indian SIM card which was operated from Pakistan for targeting defence personnel and their families using Remote Access Trojan malware.

He has been booked under sections 123 (concealing with intent to facilitate a design to wage war against the government) 121-A (conspiracy to wage war against the government), 120 B (criminal conspiracy) of the Indian Penal Code and sections of the Information Technology Act.

Superintendent of Police, ATS, Om Prakash Jat said in a press conference that ATS received information from military intelligence stating that a member of the Pakistani army or intelligence agency was using a WhatsApp number with an Indian SIM card. It was found during the investigation that the phones of an army man in Kargil and a receptionist at Army Public School in Panchkula, Haryana were compromised.

The number was being used to target Indians or Indians attached to security agencies or their families and institutions such as army public schools by compromising their phones using RAT malware. He said that the Pakistani agent sitting in the command and control centre in Pakistan would send files in the guise of "Har Ghar Tiranga" and exams-related files using Android Package (APK).

Jat said that the SIM card was issued in the name of Muhammad Saklain Thaim, a resident of Jamnagar. It was activated on a mobile device belonging to Asgar Hajibhai Modi. After activation, the SIM card was delivered to Anand, specifically to Tarapur, to Labhshankar Duryodhan Maheshwari on the instructions of a person attached to the Pakistan embassy.

Maheshwari came to India in 1999 with wife and settled in Tarapur in Anand and got Indian citizenship in 2005. ATS said that his extended family still lives in Pakistan. Earlier in 2022, he had applied for a Pakistani visa to meet his family. Maheshwari's cousin, Kishore, living in Pakistan had introduced him to a person working with the Pakistan embassy (high commission) for expediting the visa process. The visa was granted and Maheshwari and his wife visited Pakistan. Again, ATS said,

The man attached to the Pakistan embassy is reported to have instructed Maheshwari to receive the SIM card and send it to Pakistan after installing WhatsApp on his phone. Later, Maheshwari contacted the same person with the Pakistan agency to get visas for his sister and niece which was also granted. In lieu of this, he was given a SIM card and he shared OTP with the embassy official for installing WhatsApp.

Maheshwari's sister gave this card to her cousin in Pakistan, Kishore, when she visited the country. Kishore, in turn, handed over the card to a Pakistani agent. SP Jat said that the WhatsApp number was still active in Pakistan.