The Uttar Pradesh STF has arrested Arun Kumar, alias ‘Devil’, over alleged hacking of the SSC GD Constable exam server.
How was the SSC GD examination allegedly manipulated?
The Special Task Force arrested Kumar from Delhi’s Shahbad Dairy area in connection with alleged malpractice in the Staff Selection Commission GD Constable online examination. He was wanted in a case registered at Knowledge Park police station in Gautam Buddh Nagar.
According to Additional SP, STF, Raj Kumar Mishra, investigators found that hackers allegedly manipulated the examination server and connected candidates’ computers to proxy servers. This enabled remote solvers outside examination centres to access and control the systems and assist candidates during the test.
Investigators alleged that hacker Amit Rana and a person using the alias ‘Devil’ were involved in decoding source files from the examination server and making changes required for the operation. The STF later identified ‘Devil’ as Arun Kumar.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What did investigators find about the accused?
The STF said Kumar is around 30 years old, has a BA degree and completed a one-year computer fundamentals course at ITI Jahangirpuri in Delhi. He lives in Shahbad Dairy and originally belongs to the Paliganj area of Patna, Bihar.
According to investigators, Kumar said he came into contact in 2019 with a man named Manoj from Darbhanga, Bihar, while preparing for competitive examinations in Delhi’s Mukherjee Nagar. The STF alleged that he learnt computer and hacking techniques while working with Manoj and later became proficient in hacking examination servers.
Investigators said Kumar subsequently prepared modified TFT screens for alleged examination malpractice and became known as ‘Devil’ within the network.
What happened in the earlier SSC GD operation?
The arrest followed an earlier Gautam Buddh Nagar STF operation on May 22, when seven alleged members of an examination-rigging gang, including alleged main accused Pradeep Chauhan and hacker Amit Rana, were arrested from Balaji Digital Zone in Greater Noida.
Police alleged that the group installed a proxy server and hacked the examination server to connect candidates’ computers with remote solvers. The STF said ₹50 lakh in cash, a proxy server and other electronic equipment were recovered during that operation.
Kumar’s arrest has taken the number of accused arrested in the case to 12, with all sent to jail, according to the STF.
Was Kumar linked to other examination cases?
Investigators also allegedly linked Kumar to a 2024 online Nursing Staff Officer examination malpractice case in Sitapur. An FIR was registered at Talgaon police station in that matter.
The STF alleged that Kumar provided the main accused, identified as Utkarsh, with software on a pen drive that could install a proxy server and reboot the examination system. Investigators said Kumar was wanted in that case as well.
In the SSC GD examination conducted in April-May 2026, the STF alleged that Kumar decrypted certain important files and supplied them to another hacker, Amit Kumar. They allegedly prepared a script that connected the examination client to a proxy server, facilitating malpractice.
What equipment did the STF recover?
Investigators said they recovered 12 opened TFT screens, two laptops, 11 Raspberry Pi devices, eight VGA switches, 14 HDMI video-capture devices, nine USB-to-Type-C adapters, 13 HDTV-VGA adapters, nine TP-Link USB Bluetooth dongles, a broadband device, two soldering machines and other equipment during Kumar’s arrest.
The STF said modified TFT screens fitted with Raspberry Pi devices were among the electronic equipment allegedly used in the malpractice.
Kumar has been brought into the Knowledge Park police station case under provisions of the Bharatiya Nyaya Sanhita, Information Technology Act, Uttar Pradesh Public Examination Act and the Public Examination (Prevention of Unfair Means) Act, 2024. Further investigation is underway into his alleged links with other examination-rigging networks and other people who may have been involved.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
