Srinagar/New Delhi: After exposing the misuse of online gaming platforms by terror groups, security agencies have uncovered a new operational tactic adopted by terrorists and their handlers who are now using pornography websites and niche encrypted applications to communicate secretly, officials said on Sunday.
The covert channels are being used by “terror outfits and Pakistan’s intelligence agency, ISI, to convey instructions to recruits in Jammu and Kashmir” while evading surveillance on conventional social media platforms.
Officials said “these pornography platforms feature real-time chat tools, operating under the guise of helping users find dates nearby, which handlers exploit to broadcast messages and coordinate activities.”
Security agencies have placed a wide array of specialised digital tools under scrutiny. Terror handlers are relying on Tor-based messaging applications like Coatex and Conion to route data through encrypted nodes and obscure user identities.
Access to the APK for Conion reportedly faces restrictions within India. An APK file (Android Package Kit) is the file format used by the Android operating system to distribute and install mobile apps.
Additionally, they are using privacy-focused platforms such as a France-based app that allows end-to-end encrypted messaging without requiring a SIM card or phone number, making user attribution difficult.
Agencies are also monitoring Vietnam-based apps alongside anonymous platforms like Moonchat, which includes PGP-encrypted versions with suspected Chinese origins that bypass traditional registration. This app has many versions used for finding singles in your vicinity.
Though several of these porn applications are banned in India, they are downloaded illegally using Virtual Private Network (VPN). A VPN creates a secure and encrypted connection over the internet by masking Internet Protocol addresses and encrypting online traffic, making it more difficult to track online activity and access data.
Security experts feel that many platforms using the Tor network present unique tracking challenges by bouncing encrypted traffic through multiple volunteer-run relay nodes globally to hide both the origin and destination of the data.
While Tor is maintained by the US-based non-profit, The Tor Project, for legitimate privacy and anti-censorship efforts, its anonymity features are increasingly being exploited by clandestine networks including terror groups.
The officials said that security agencies continue to adapt their cyber-surveillance frameworks to map and intercept these off-grid communication channels.
Justifying the ban on these apps, the officials said “terror groups were increasingly using the encrypted instant messaging applications of porn sites in recruiting and radicalising youths in Jammu and Kashmir”.
In a departure from the use of conventional social media, handlers are now reaching out to prospects through these platforms which, in order to evade detection, differ from each other in terms of the level of security they provide.
While some apps offer basic encryption features, others employ end-to-end encryption, self-destruct messages, and the RSA-2048 encryption algorithm that processes data on the user device without any third-party interference.
RSA is an American Network Security and Authentication company founded in 1982 by US-born Ron Rivest and Leonard Adleman and Israeli-born Adi Shamir. The acronym RSA is used worldwide as the foundation key in the cryptosystem.
The trend has witnessed terrorists moving away from commonly used social media apps like WhatsApp, Facebook Messenger and Signal, the officials said.
The security officials observed that both handlers and recruits from the Valley had been relying on specific applications which work even when there is a slower 2G or EDGE network speed. Some of these applications do not even require a phone number or email from the user while registering.
The new tactics were uncovered as security forces strived to combat the use of foreign-generated virtual SIM cards. Developed by foreign-based companies, virtual SIM cards enable the computer to generate phone numbers that can be used on smartphones through specific applications, leaving negligible digital traces.
It was first exposed during the investigation into the 2019 Pulwama terror attack in which 40 CRPF personnel died. The detailed investigation done by the NIA found that more than 40 virtual SIM cards were used by the Jaish-e-Mohammed suicide bomber and his accomplices in the attack.
