Cyber Threat Actor: Rajshekhar Rajaharia

The threat actor knownby the alias Rajshekhar Rajaharia is associated with an alleged data breach that was reported on 27 February 2021 involving an Indian over‑the‑top (OTT) streaming service identified as Zee5. The actor’s location is indicated as India, based on the alias and the geographic focus of the reported incident. According to open‑source reporting, the breach allegedly exposed personal information of approximately nine million users, with the leaked data consisting of names and email addresses. A security researcher who discovered the leak claimed that his own records appeared in the sample, providing a personal verification point for the alleged exposure. Zee5 publicly denied that any breach had taken place, asserting that its internal logs showed no compromise and that the platform’s systems remained secure. The company declined to provide further clarification or engage with researchers seeking verification, leaving the validity of the leak unresolved. Observers noted that the incident marked the second reported security event affecting the platform within a twelve‑month period, adding context to the recurrence of security concerns. Discrepancies between the researcher’s findings and the company’s statement raised unresolved questions about the authenticity of the leaked sample, though no definitive conclusion was reached in the public domain. The actor’s known activity is therefore limited to this single reported incident, with no additional attacks or operations publicly attributed to the alias at this time.

The only publicly evidenced targeting linked to Rajshekhar Rajaharia is the media and entertainment sector, specifically an Indian OTT platform, and no other sectors, regions, or victim profiles have been documented in open sources for this actor. Strategic objectives such as financial gain, espionage, or disruption are not explicitly stated in the available reporting, so they cannot be inferred or ascribed to the actor based on the current information. Likewise, no specific malware families, initial‑access vectors, tooling styles, or technical tactics have been described in connection with the alleged breach, leaving the actor’s methodological profile undefined. No public information establishes a state nexus, criminal consortium, or other affiliation for Rajshekhar Rajaharia, and the alleged Zee5‑related data breach remains the sole representative operation that can be referenced when describing the actor’s known activity. Consequently, any further characterization of the actor’s motives, capabilities, or broader campaign patterns would require additional verified information beyond what is presently disclosed in open sources. The profile presented here reflects strictly the facts that have been publicly reported concerning this alias and incident.