From Mukherjee Nagar to reverse engineering expert: how Special Task Force UP arrested hacker ‘Devil’

Lucknow / Greater Noida / Delhi | 23 September 2026

Uttar Pradesh’s Special Task Force has arrested Arun Kumar alias “Devil”, a 30-year-old alleged exam-hacking specialist wanted in the Staff Selection Commission (SSC) GD Constable online-examination fraud case.

He was picked up at about 6 p.m. on 22 September 2026 from Shahabad Dairy in Delhi’s Begumpur police-station area and produced in FIR No. 104/2026 at Knowledge Park police station, Gautam Buddha Nagar.

The arrest, recorded in STF Press Note No. 279 dated 23 September 2026, is the latest cut in a case that began with a May raid at an exam centre in Greater Noida and has since widened to centre-selection contractors, proxy-server operators, and a technical network stretching across several states.

The Accused

According to the STF, Devil is the son of Teja Yadav.

He was living at 354, Shahabad Dairy, Begumpur, Delhi.

His native village is Paliganj, Dadri police-station area, Patna district, Bihar.

He is a BA graduate and completed a one-year computer fundamentals course at ITI Jahangirpuri.

In interrogation he put his age at about 30.

He is a different person from another Arun Kumar, a Mathura resident and former invigilator / IT head at the Greater Noida centre, who was among the seven men arrested on 22 May 2026.

The two names have already begun to blur in some reporting; the press note is clear that Devil is the Delhi-based hacker who worked on server source files and scripts, not the centre’s on-site IT staffer.

What police seized

STF listed the following recoveries:

• 12 open TFT screens
• 2 Laptops (1 ThinkPad, 1 Apple)
• 11 Raspberry Pi devices
• 14 Video Capture (HDMI) devices
• 8 VGA Switch, 13 HDTV VGA Adapter, 4 VGA to HDTV Adapter
• 9 USB to Type C adapters, 9 TP Link USB Bluetooth Dongles
• 1 Hand Held Metal Detector, 1 Excitel Broadband Device
• 2 Iron Solder Machines

The kit matches the two techniques described in the case: remote control of candidate terminals through a proxy path, and “modified TFT” hardware used in other exam-fraud jobs.

Raspberry Pi boards, video-capture dongles, VGA switches and open TFT panels are typical of a lab that can intercept, clone or reroute display and input streams rather than a conventional coaching setup.

How the case started: Balaji Digital Zone, 22 May 2026

STF units had been told that organised groups were manipulating multiple public examinations.

A team under Additional Superintendent of Police Raj Kumar Mishra (STF Field Unit, Noida), with Deputy Superintendent Navendu Kumar and Sub-Inspector Akshay P.K. Tyagi, developed the Greater Noida lead.

On 22 May 2026, during the SSC GD Constable examination at Balaji Digital Zone in Knowledge Park, Greater Noida, the Gautam Buddha Nagar STF team arrested seven people, including alleged organiser Pradeep Chauhan and hacker Amit Rana.

Police seized about ₹50 lakh in cash, a proxy server and other material.

FIR 104/2026 was registered at Knowledge Park police station.

Earlier contemporaneous reports named the May arrestees as Pradeep Chauhan (Muzaffarnagar), Arun Kumar (Mathura), Sandeep Bhati and Nishant Raghav (Bulandshahr), Amit Rana and Shakir Malik (Baghpat), and Vivek Kumar (Bulandshahr).

Investigators then said the gang charged about ₹4 lakh per candidate: ₹50,000 to the person who sourced the candidate and the rest shared among the organiser, the hacker and the remote solver.

The alleged method was not a direct breach of SSC’s central systems.

The centre was running the exam for vendor Eduquity.

A proxy server was installed at the venue; the official path was bypassed; a screen-sharing / remote-control link was opened to a solver sitting outside.

The candidate’s machine could then be driven from off-site.

The press note says investigation later showed that hackers Amit Rana and Devil decoded the server source file and altered it so the proxy path would work, and that candidates’ computers were controlled from outside the exam hall.

Sections Invoked

The case is being investigated under:

• Bharatiya Nyaya Sanhita: Sections 318(2), 338, 336(3), 340(2) and 61(2)
• Information Technology Act: Sections 65 and 66
• Uttar Pradesh Public Examination Act: Sections 13(4) and 13(5)
• The Public Examination (Prevention of Unfair Means) Act, 2024: Sections 10(1), 10(2), 10(3) and 11(1)

After Devil’s arrest, STF says 12 accused in this FIR have been sent to jail.

Large numbers of Raspberry Pi units, modified TFT screens and other exam-fraud hardware have already been recovered on the pointing-out of arrested accused.

The centre-selection layer

The May raid did not end the inquiry.

On 22 September 2026, the same calendar window as Devil’s arrest, STF also detained two directors of Assessinfra Technology Pvt. Ltd., the firm contracted to select examination centres in northern states for Eduquity.

They were identified in reporting as Gagandeep Sharma and Yadavendra Singh, both from Jaipur.

That took the then-count to 10 accused before Devil was added.

STF’s public account is that Eduquity was SSC’s executing agency; Eduquity contracted Aces/ASSESS Infra for centre selection; and Balaji Digital Zone itself had been designated as an SSC centre by that contractor.

Investigators have alleged that the firm continued to notify a laboratory linked to Chauhan even after earlier red flags.

Those allegations will be tested in court; they matter because they describe a supply chain, not a one-room cheat.

How ‘Devil’ says he learned the trade

In interrogation, as recorded by STF, Arun Kumar alias Devil described a familiar Mukherjee Nagar pipeline.

In 2019, while preparing for competitive examinations in Mukherjee Nagar, Delhi, he met a man named Manoj, a resident of Darbhanga, Bihar, who was then running online examinations.

Working with him, Devil learned “screen lifting”, remote capture and control of exam screens.

He later specialised in server hacks and in building modified TFT hardware for exam fraud.

In that milieu he became known as Devil.

STF says operators involved in exam malpractice from Uttar Pradesh, Haryana, Bihar, Jharkhand and the North-East came into contact with him.

That is the basis for the “five-state network” line in subsequent news coverage; the press note itself lists those regions as contact zones, not as proven completed jobs in each state.

Sitapur thread

Devil was already wanted in a 2024 case.

A gang allegedly manipulating an online Nursing Staff Officer examination was caught in Sitapur district.

FIR No. 266/2024 was registered at Talgang police station.

STF says Devil supplied software on a pen drive to the main accused, Utkarsh, so a proxy server could be installed and systems rebooted.

That earlier warrant is one reason the Noida team treated him as a priority target rather than a new name.

His alleged role in the 2026 SSC GD paper

For the April–May 2026 SSC GD Constable online examination conducted through Eduquity, STF says Devil decrypted important files and passed them to hacker Amit Kumar / Amit Rana.

The two together wrote a script that connected the client (candidate terminal) to the proxy server.

That script, police allege, is what made remote solving possible at the compromised centre.

The hardware seized in Delhi, Raspberry Pi boards, HDMI capture cards, VGA matrices, Bluetooth dongles, open TFTs and soldering kits, is consistent with a person who both wrote the software path and fabricated or modified the physical intercept layer.

What this case actually shows

Three points are now on the record, and they should be kept separate from speculation.

1. First, the fraud described here is venue-level, not a claimed collapse of SSC’s national question-bank. The official exam software still ran in the hall; the alleged crime was to sit a parallel control path beside it.
2. Second, the economics are blunt. A ₹4-lakh-per-seat promise, ₹50 lakh cash on a single raid, and a hardware store of capture devices point to a commercial service, not a one-off leak by a desperate candidate.
3. Third, the network is thicker than one hacker. Organisers who run digital centres, a vendor that conducts the paper, a contractor that chooses venues, remote solvers, and a specialist who can decode source files and ship reboot tools on a pen drive are all now in the same case file. Devil is the technical node the May accused pointed toward; he is not the entire organisation.

STF says inquiry into his other activities is continuing.

He has been formally added to FIR 104/2026 and further legal process is underway.

This article is based on STF Uttar Pradesh Press Note No. 279 (23 September 2026) and contemporaneous reporting of the May 2026 Greater Noida raid and the September 2026 follow-on arrests. All accused remain entitled to the presumption of innocence unless convicted.