Rona Wilson, an activist who is a key accused in the Bhima Koregaon case, has moved Bombay High Court after Arsenal Consulting, a Massachusetts-based digital forensics firm, analysed an electronic copy of his laptop and arrived at the conclusion that an attacker used malware to infiltrate the laptop and place incriminating evidence on it.
Wilson is demanding an inquiry by a Special Investigation Team (SIT) into the possible planting of evidence on his laptop. Wilson had been accused based on a letter he allegedly wrote to a Maoist group leader, discussing the need for guns and ammunition, and asking the group to assassinate Prime Minister Narendra Modi. According to a report by the Washington Post, Arsenal Consulting found that the letter — along with at least nine others — had been planted in a hidden folder on Wilson’s computer by an unidentified attacker who used NetWire, a malware, to control and spy on the laptop.
According to Arsenal Consulting’s findings, Wilson received emails that appeared to be from a fellow activist, urging him to click on a link to download an innocuous statement from a civil liberties group. But this link actually deployed NetWire, a malicious software that allowed a hacker to access Wilson’s computer.
Arsenal found that the malware logged Wilson’s keystrokes, passwords and browsing activity. The attacker created the hidden folder to which at least 10 incriminating letters were delivered, and then tried to conceal those steps. The letters were created using a newer version of Microsoft Word that did not exist on Wilson’s computer, discovered Arsenal. Moreover, Arsenal found no evidence that the documents or the hidden folder were ever opened.