Module-2: Cybercrime and Cyber law

Classification of cyber crimes, Common cyber crimes- cyber crime targeting

computers and mobiles, cyber crime against women and children, financial frauds,
social engineering attacks, malware and ransomware attacks, zero day and zero click
attacks, Cybercriminals modus-operandi, Reporting of cyber crimes, Remedial and
mitigation measures, Legal perspective of cyber crime, IT Act 2000 and its
amendments, Cyber crime and offences

Category Sub-Category Definition Examples

Using stolen credit
Stealing personal information
card details to make
to commit fraud, such as using
unauthorized
Identity Theft someone’s social security
purchases, opening
number or bank details without
bank accounts in
permission.
someone else’s name.
The use of digital platforms to
Posting hurtful
harass, threaten, or intimidate
comments on social
Cyberbullying an individual, often involving
media, sending
social media, messaging apps,
threatening emails.
or emails.
Threatening to release
Threatening to release intimate
private photos unless
or embarrassing content unless
Cybercrimes Sextortion the victim pays money
the victim pays a ransom or
Against or provides more
complies with demands.
Individuals explicit content.
Fake lottery emails,
Fraudulent schemes that fraudulent investment
deceive victims into providing opportunities,
Online Scams
personal or financial phishing emails
information. asking for bank
details.
Sending threatening
Following or harassing an messages through
individual over the internet email or social media,
Harassment &
through repeated, unwanted using tracking
Cyber Stalking
communication or software to monitor
surveillance. someone’s online
activities.
Gaining unauthorized
Unauthorized access to access to a company's
Hacking computer systems or networks database to steal
to steal, alter, or destroy data. sensitive customer
data.
Cybercrimes
Copying and selling
Against The illegal copying,
software without
Property Software distribution, or use of software
licensing, distributing
Piracy without permission from the
cracked software
developer or publisher.
online.
Stealing sensitive information, Stealing personal data
Data Theft
often from organizations or like Social Security
 individuals, for financial gain numbers or financial
or competitive advantage. records from a hacked
system.
Engaging in fraudulent
Altering digital
activities through digital
records in a financial
Digital Fraud platforms, such as altering data
database to redirect
or making unauthorized digital
funds.
transactions.
Hacking into a
competitor's network
Stealing confidential business
Corporate to steal trade secrets,
information, often to gain a
Espionage using insider
competitive advantage.
knowledge to leak
company data.
Sending fake emails
Fraudulent attempts to acquire
from banks asking for
sensitive information such as
Phishing login details or using
login credentials or financial
Attacks fraudulent websites
information by pretending to
that look like official
be a trustworthy entity.
ones.
Cybercrimes Attacking an e-
Against Denial of Overloading a server or commerce website by
Organizations Service network with traffic to make it flooding it with traffic
(DoS)/DDoS unavailable to legitimate users. to crash it during peak
shopping hours.
Locking a company's
Malware that encrypts a
files with encryption
victim’s data, with the attacker
Ransomware and demanding a
demanding payment for
ransom for the
decryption.
decryption key.
Hacking a third-party
Compromising a vendor or
vendor’s system to
Supply Chain supplier’s network to gain
breach a larger
Attacks unauthorized access to a target
corporation’s network
organization’s system.
and steal data.
Using computer resources to
Attacking critical
intimidate or coerce a
Cyber infrastructure like
government, population, or
Terrorism power grids to cause
society to promote political
fear or disruption.
objectives.
The act of spying or stealing
Hacking into
classified or sensitive
Cybercrimes government servers to
information from governments
Against State Espionage steal national defense
or organizations, often for
plans or intelligence
political or economic
data.
purposes.
A country using
State-sponsored or politically
cyberattacks to disrupt
Cyber Warfare motivated cyberattacks aimed
another country’s
at disrupting or damaging
government services,
 another nation’s digital banking systems, or
infrastructure. military operations.
A computer virus that
Malware programs that spread
Cybercrimes infects thousands of
Virus/Worm across networks, damaging
Involving systems by exploiting
Attacks files, corrupting systems, or
Technology a vulnerability in an
disrupting operations.
operating system.
A malicious file
Malicious programs disguised
disguised as an
as legitimate software,
innocent-looking
Trojan Horses enabling unauthorized access
software download
to a victim’s computer or
that gives an attacker
network.
access to a computer.
Software that secretly A software program
monitors and collects that tracks users’
Spyware information about a user’s browsing habits and
activity, often without their sends this data to
consent. cybercriminals.
A network of
Networks of infected devices thousands of infected
controlled remotely to carry computers used to
Botnets
out attacks, often used for launch a coordinated
DDoS attacks or to send spam. DDoS attack against a
major website.
Sharing illegal child
The creation, distribution, or
Cybercrimes Child pornography via
possession of illegal content
Involving Exploitation & online platforms or
involving minors, often
Content Pornography dark web
through online platforms.
marketplaces.
Downloading and
The unauthorized use or
distributing pirated
Intellectual distribution of copyrighted
movies or software
Property Theft material, trademarks, or
without proper
patents.
authorization.
Operating unlicensed
Running illegal gambling
Online online betting
operations online or
Gambling and platforms or
manipulating betting systems
Fraud manipulating virtual
for financial gain.
games to ensure a win.
Posting false and
The act of damaging
Defamation damaging information
someone’s reputation by
and about a person or
spreading false information
Misinformation company on social
online.
media or websites.
Cybercrimes Making online
Using stolen or fake credit card
Involving Credit Card purchases using
details to make unauthorized
Financial Fraud someone else’s stolen
transactions.
Systems credit card number.
Online Unauthorized access or Hacking into a bank’s
Banking Fraud transactions made on an online system to
 individual’s online bank transfer funds from a
account. victim’s account to a
fraudulent one.
Using phishing
Fraudulent schemes that
techniques to steal
involve the theft or
Cryptocurrency cryptocurrency wallet
manipulation of
Fraud credentials, or running
cryptocurrency for financial
a fake initial coin
gain.
offering (ICO).
Running a fake
Fraudulent investment cryptocurrency
Ponzi and schemes conducted through investment platform
Investment digital platforms, often that deceives investors
Schemes involving fake promises of into sending money,
high returns. promising high
returns.
A hacking group
breaching a
The unauthorized access and company’s database
Data Breaches distribution of sensitive and releasing
personal or corporate data. customer data,
including emails and
credit card details.
Using social media to
Illegally obtaining, using, or
Privacy collect personal data
selling personal data without
Violations and then selling it to
Cybercrimes the individual’s consent.
third-party marketers.
Related to
Using spyware to
Privacy and
track someone’s
Data Unauthorized monitoring or
Surveillance location or activities
tracking of individuals or
and Tracking via their smartphone
systems using digital tools.
or computer without
their knowledge.

2.2 Cybercrime Targeting Computers and Mobiles

Cybercrime targeting computers and mobile devices has become a significant concern in
today’s digital world, with criminals exploiting technology for financial gain, data theft, or
causing harm. The common types of cybercrimes include:
Cybercrime Type Description
Malware Attacks Malicious software (viruses, Trojans, spyware, ransomware, etc.)
designed to infect devices, steal data, or cause system damage.
Phishing Fraudulent attempts to obtain sensitive information like passwords
or credit card details by posing as a legitimate entity.
Identity Theft Stealing personal information to commit fraud or gain
unauthorized access to financial resources.
Online Scams Fraudulent schemes such as advance-fee fraud, lottery scams, or
romance scams that deceive individuals into sending money or
personal info.
 DDoS Attacks Distributed Denial of Service attacks overload networks with
traffic, making them unavailable and causing disruption.
Data Breaches Unauthorized access to and theft of sensitive data like financial
records, customer information, or trade secrets.
Cyberbullying Using technology to harass, intimidate, or threaten individuals,
often affecting young people through social media and messaging
apps.
Mobile Device Theft Stealing or hacking into mobile devices to access personal data or
and Hacking install malware.
Cyber Extortion Threatening to release sensitive information unless a ransom is
paid, including sextortion.
Insider Threats Employees or insiders misusing access to steal or manipulate
company data.
Cryptojacking Unauthorized use of a victim’s device to mine cryptocurrency,
reducing performance and increasing energy consumption.
2.3 Cybercrime Against Women and Children
Cybercrimes targeting women and children are particularly harmful, often involving
harassment, exploitation, or abuse. Common types include:
Cybercrime Type Description
Cyberbullying Harassment or intimidation through digital platforms like social media
or messaging apps.
Online Sending unsolicited offensive messages, images, or threats to women
Harassment or children.
Revenge Porn Sharing explicit images or videos without consent, typically to cause
harm or as an act of revenge.
Sexting Coercing minors into sharing explicit images, leading to blackmail or
Exploitation exploitation.
Online Grooming Predators manipulate children online for sexual exploitation, gradually
building trust and encouraging inappropriate behavior.
Child Distribution, possession, or creation of illegal material exploiting
Pornography children.
Online Using the internet to recruit and exploit women and children for forced
Trafficking labor or sexual exploitation.
Cyberstalking Persistent online harassment, causing emotional distress or fear.
Financial Fraud Scams targeting women, such as fake investment schemes or online
dating frauds.
Privacy Unauthorized sharing of personal information or photos, leading to
Violations identity theft or other forms of cybercrime.
2.4 Financial Frauds
Financial frauds are a serious concern in the digital world, with various methods used to deceive
individuals and organizations. Types include:
Fraud Type Description
Ponzi Schemes Fraudsters promise high returns but use new investor funds to pay
old investors, creating a false impression of profitability.
 Identity Fraud Stealing personal information through phishing, malware, or data
breaches to commit fraud.
Fraudulent Creating fake charities to solicit donations that disappear with the
Charities fraudster.
Credit Card Fraud Stealing or cloning credit card information to make unauthorized
transactions.
Stock Market Fraudsters manipulate stock prices through tactics like insider
Manipulation trading or false information to deceive investors.
Bank Frauds Includes loan frauds, cheque frauds, forged documents, and
unauthorized transactions, leading to significant financial losses.
2.5 Social Engineering Attacks
Social Engineering exploits human behavior to deceive individuals into revealing confidential
information. It includes both human-based and computer-based tactics:
Social Engineering Description
Type
Human-based Direct interaction, such as impersonating employees or using
authority figures to gain access to information.
Computer-based Using digital methods like phishing emails, malicious attachments, or
pop-up windows to deceive users.
Types of Human-based Social Engineering:
1. Impersonating an Employee: The attacker pretends to be an employee to gain
sensitive information.
2. Posing as an Important User: The attacker pretends to be a high-ranking official (e.g.,
CEO) to intimidate employees.
3. Using a Third Person: The attacker claims permission from an authorized source to
gain access to a system.
4. Calling Technical Support: Attacker contacts help desk to acquire sensitive data,
exploiting the staff's helpful nature.
5. Shoulder Surfing: Observing a person’s actions to steal sensitive information (e.g.,
passwords).
6. Dumpster Diving: Scavenging trash for valuable information, such as documents or
printouts.
Types of Computer-based Social Engineering:
1. Fake Emails (Phishing): Fraudulent emails pretending to be legitimate to steal
sensitive data.
2. Email Attachments: Malicious attachments that execute malware upon opening.
3. Pop-up Windows: Encouraging victims to click on fake offers, installing malicious
code.
Malware and Ransomware Attacks
Malware is malicious software designed to damage, steal, or compromise data. Common types
of malware include:
Malware Type Description
Adware Displaying unwanted ads, often leading to further malicious
activity.
 Viruses Malicious programs that corrupt files, disrupt operations, or deliver
harmful payloads.
Worms Self-replicating viruses that spread across networks, exhausting
resources.
Trojans Malicious programs masquerading as legitimate software, often
allowing remote control of infected devices.
Bots Infected devices used as part of a botnet to perform large-scale
attacks, like DDoS.
Keyloggers Software that records keystrokes to capture sensitive data like login
credentials.
RAT (Remote Access Tools that allow attackers to control a system remotely.
Tools)
Downloaders Malware that downloads other malicious software to an infected
system.
POS Malware Malware targeting Point-of-Sale systems to steal credit card and
financial data.

2.6 Modus Operandi of Cyber Criminals

Method Description Example
Sending Cybercriminals send misleading, A scam email pretending to be
Annoying harassing, or malicious messages via from a bank asking for sensitive
Messages email, SMS, or social media. information.
Making Criminals use fake numbers or phone A criminal pretending to be
Offensive spoofing to harass victims, or make from the government
Calls threatening calls for extortion. demanding money over the
phone.

2.7 Reporting Cyber Crimes

Reporting Method Description Example
Local Law Report cybercrimes to local police Reporting identity theft to the
Enforcement for investigation and legal action. local police.
National Countries have agencies like the Reporting an online fraud
Cybersecurity FBI's IC3 (Internet Crime scheme to the FBI in the U.S.
Agencies Complaint Center) to report serious or CERT-In in India.
crimes.
Online Platforms Report directly to the platform or Reporting harassment or
service provider where the crime impersonation on Facebook.
took place (e.g., Facebook, Gmail).
Anti-Fraud Report to organizations like APWG Reporting phishing websites
Organizations (Anti-Phishing Working Group) for or emails to APWG.
phishing-related crimes.
Financial Financial crimes like online fraud or Reporting fraudulent
Institutions unauthorized bank transactions transactions to a bank or credit
should be reported to banks. card company.
 ISPs Internet Service Providers often Reporting hacking attempts
track cybercriminal activities and using IP addresses through an
assist in investigations. ISP.
Documentation Gather evidence like screenshots, Taking screenshots of
emails, URLs, IP addresses, or phishing emails as evidence.
digital footprints to aid
investigations.
Online Reporting Use government-run portals for Filing a report on India’s
Portals filing cybercrime complaints, often Cyber Crime portal.
with anonymity options.
Legal Advice Seek legal help when needed, Consulting a lawyer for
especially for complex or significant advice on how to proceed with
crimes. cyber extortion cases.
Protect Yourself Implement preventive measures like Installing antivirus software
changing passwords and using and enabling two-factor
security software. authentication.

2.8 Remedial and Mitigation Measures

Measure Type Description Example
Remedial Measures Actions taken to immediately
address the impact of a
cybercrime.
Incident Response The initial steps to contain and Disconnecting a compromised
resolve the attack. server from the internet during
a DDoS attack.
Forensic Investigation Examining affected systems to Conducting a forensic
trace the cybercriminal's actions investigation of a server after a
and gather evidence. data breach.
Data Recovery Restoring data from backups in Using a backup to restore files
case of corruption or deletion due lost due to a ransomware
to ransomware. attack.
Mitigation Measures Long-term actions to prevent
cybercrimes from happening
again.
Strong Security Implementing firewalls, antivirus Installing firewalls to block
Practices programs, and intrusion detection unauthorized network access.
systems.
Regular Keeping software and systems Installing security patches for
Updates/Patching updated to avoid security software vulnerabilities like
vulnerabilities. Log4j.
Employee Education Conducting training sessions to Organizing monthly
help employees recognize cybersecurity awareness
phishing and other attacks. programs for staff.
Multi-Factor Requiring more than one form of Enabling MFA on email and
Authentication (MFA) verification to access systems. bank accounts.
 Data Encryption Encrypting sensitive data to make Using encryption to protect
it unreadable to unauthorized financial transactions over the
users. internet.
Regular Audits Periodically reviewing systems Conducting annual
and data for weaknesses or cybersecurity audits for an
potential threats. organization’s infrastructure.

2.9 Legal Perspective of Cyber Crime

Aspect Description Example
Cyber Laws Laws addressing various The Information Technology
cybercrimes such as hacking, Act, 2000 in India governs
cyberstalking, and identity theft. cybercrime offenses.
Electronic Signatures Laws recognizing digital Using e-signatures in
signatures as valid and enforceable contracts for business
in a court of law. transactions.
Intellectual Property Protecting online intellectual A company suing for
property like software, music, and copyright infringement of its
patents. software online.
Data Laws that require individuals and GDPR in Europe protecting
Protection/Privacy organizations to protect the privacy user data from misuse by
of personal and sensitive data. organizations.
Legal Perspective in India's specific laws, including Section 66C of the IT Act
India amendments to handle new forms punishes identity theft in
of cybercrime and digital India.
transactions.
Information The primary law in India The IT Act deals with
Technology Act, 2000 addressing cybercrimes, including cybercrimes like phishing
hacking, data theft, and cyber and online fraud.
terrorism.
Amendments Updates to the laws to address The 2008 amendments
newer threats like cyber terrorism, introduced harsher penalties
privacy issues, and digital for cyber terrorism.
evidence.

2.10 Cyber Crime and Offenses

Crime Type Description Example
Hacking Unauthorized access to systems, A hacker breaking into a
networks, or databases to steal, alter, government database to steal
or delete data. classified information.
Identity Theft The unauthorized use of someone A criminal using someone’s
else’s personal information for credit card number to make
fraudulent purposes. unauthorized purchases.
Phishing/Spoofing Using fraudulent emails or websites An email pretending to be from
to deceive users into revealing a bank asking for login
sensitive personal information. credentials.
 Cyberbullying Using the internet or social media A person repeatedly sending
platforms to harass, threaten, or hurtful messages or spreading
humiliate someone. rumors online.
Online Fraud Scams where criminals trick victims A fraudulent online store that
into sending money or goods. doesn't deliver the purchased
products.
DDoS Attacks Overloading a website or server with A DDoS attack shutting down
traffic to make it unavailable to an e-commerce website during
users. a sale event.
Cyber Espionage Hacking into systems to steal A state-sponsored attack to
confidential information for steal military secrets from
competitive or political advantage. another country.
Child Creating, sharing, or possessing A criminal involved in the
Exploitation illegal content involving minors. distribution of child
pornography online.
Ransomware Malicious software that encrypts a A hospital's data is locked, and
victim’s data and demands payment a ransom is demanded for
for decryption. recovery.
Cyberstalking Using the internet to repeatedly A stalker using social media to
follow, harass, or threaten an track and harass someone
individual. online.

2.11 Organizations Dealing with Cybercrime and Cybersecurity in India

Organization Description Example
NCSC (National Cyber Works under the Prime NCSC coordinating
Security Coordinator) Minister’s Office to oversee national cybersecurity
cybersecurity initiatives across responses during a cyber
the country. attack.
CERT-In (Computer The national agency for CERT-In issuing alerts and
Emergency Response responding to and preventing guidelines during malware
Team - India) cyber threats, offering solutions outbreaks.
to security incidents.
NCIIPC (National Focuses on protecting critical NCIIPC securing India’s
Critical Information national infrastructure against nuclear power plants and
Infrastructure Protection cyber threats. critical sectors from cyber
Centre) attacks.
State Police Cyber Cells Police units in each state that Cybercrime police in
specialize in handling Bengaluru investigating
cybercrime cases. online fraud cases.
NIA (National Special agency handling NIA investigating a
Investigation Agency) cyberterrorism and high-profile cyberattack involving a
cybercrime cases. terrorist group.
Cyber Appellate Tribunal An independent judicial body A tribunal ruling on a case
for resolving cybercrime and of online harassment and
cybersecurity-related disputes in defamation.
India.
Banks & Financial Regulate cybersecurity in the Banks ensuring secure
Institutions financial sector, ensuring the online transactions with
safety of digital transactions. encryption.
Private Cybersecurity Provide services like risk Firms like McAfee or
Firms assessments, security audits, and Kaspersky offering cyber
penetration testing to businesses. defense solutions to
enterprises.